Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
2353 vulnerabilities reference this CWE, most recent first.
CVE-2026-92114 (GCVE-0-2026-92114)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:30 – Updated: 2026-09-16 19:13
VLAI
EPSS
VEX
Title
a2ui-project a2ui Basic Catalog safe_regex.ts redos
Summary
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:13 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404283 | vdb-entry |
| https://vuldb.com/vuln/404283/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-92114 | third-party-advisory |
| https://vuldb.com/submit/934085 | third-party-advisory |
| https://github.com/a2ui-project/a2ui/issues/2292 | issue-tracking |
| https://github.com/a2ui-project/a2ui/pull/2366 | issue-trackingpatch |
| https://github.com/a2ui-project/a2ui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2ui-project | a2ui |
Affected:
0.10.0
Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:13:12.763135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:13:23.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Catalog"
],
"product": "a2ui",
"vendor": "a2ui-project",
"versions": [
{
"status": "affected",
"version": "0.10.0"
},
{
"status": "affected",
"version": "0.10.1"
},
{
"status": "affected",
"version": "0.10.2"
},
{
"status": "affected",
"version": "0.10.3"
},
{
"status": "affected",
"version": "0.10.4"
},
{
"status": "affected",
"version": "0.10.5"
},
{
"status": "affected",
"version": "0.10.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:30:19.468Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404283 | a2ui-project a2ui Basic Catalog safe_regex.ts redos",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/404283"
},
{
"name": "VDB-404283 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404283/cti"
},
{
"name": "CVE-2026-92114 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-92114"
},
{
"name": "Submit #934085 | a2ui-project a2ui 0.10.6 CWE-1333",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/934085"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/a2ui-project/a2ui/issues/2292"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2ui-project/a2ui/pull/2366"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2ui-project/a2ui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T17:41:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2ui-project a2ui Basic Catalog safe_regex.ts redos",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-92114",
"datePublished": "2026-09-15T21:30:19.468Z",
"dateReserved": "2026-09-15T15:35:54.705Z",
"dateUpdated": "2026-09-16T19:13:23.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92003 (GCVE-0-2026-92003)
Vulnerability from cvelistv5 – Published: 2026-09-15 11:43 – Updated: 2026-09-15 12:32
VLAI
EPSS
VEX
Title
MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
Summary
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.
Two API authentication failure branches wrote directly to the Log model:
- API requests with no authentication key;
- requests supplying an API key with an incorrect length
Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.
Version affected: ≤2.5.45
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 12:31 UTC
CWE
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/2bf887433 | patch |
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-15 11:37 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/2bf887433.patch
db6f78e69079… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
2bf887433651
|
fix: [logging] Throttle the two unguarded auth_fail writes | db6f78e69079… |
Fix summary
The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client's source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read('CurrentRequestAuthFailKeys')) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator's log_each_individual_auth_fail setting.
Patch summary
In app/Controller/AppController.php: (1) The 'no authkey' branch in beforeFilter() now calls _shouldLog('noauthkey:' . $this->User->_remoteIp()) before writing the log entry. (2) The 'incorrect length' branch in __loginByAuthKey() now calls _shouldLog('badauthkeylength:' . $this->User->_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure 'CurrentRequestAuthFailKeys') to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.
CVSS rationale
The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.
Weakness rationale
- CWE-770 Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle.
- CWE-400 The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact.
Assumptions to verify
- The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.
- The log entries are written to a relational database (MySQL/PostgreSQL) via MISP's Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.
- The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.
- CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | medium | 4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T12:31:54.934768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T12:32:06.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app/Controller/AppController.php"
],
"product": "MISP",
"programFiles": [
"app/Controller/AppController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\u003c/p\u003e\n\u003cp\u003eTwo API authentication failure branches wrote directly to the \u003ccode\u003eLog\u003c/code\u003e model:\u003c/p\u003e\u2003- API requests with \u003cstrong\u003eno authentication key\u003c/strong\u003e;\u003cbr\u003e\u003cdiv\u003e\u2003- requests supplying an API key with an \u003cstrong\u003eincorrect length\u003c/strong\u003e\u003c/div\u003e\u003cdiv\u003e\u003cstrong\u003e\u003cbr\u003e\u003c/strong\u003e\u003c/div\u003e\u003cp\u003eUnlike other authentication failures, these paths bypassed \u003ccode\u003e_shouldLog()\u003c/code\u003e, so every request could create another durable \u003ccode\u003eauth_fail\u003c/code\u003e entry.\u003c/p\u003eVersion affected: \u22642.5.45\u003cbr\u003e"
}
],
"value": "Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle.\n\n\nTwo API authentication failure branches wrote directly to the Log model:\n\n\u2003- API requests with no authentication key;\n\u2003- requests supplying an API key with an incorrect length\n\n\n\n\nUnlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry.\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T11:43:19.403Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/2bf887433"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting.\u003c/p\u003e"
}
],
"value": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting."
}
],
"title": "MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The tag_version_boundary (v2.5.46, 188 commits after fix) is used as an approximate upper bound for affected versions; the exact fixed release tag is not stated in the patch metadata.",
"The log entries are written to a relational database (MySQL/PostgreSQL) via MISP\u0027s Log model, based on the createLogEntry() call pattern; the specific backend is not confirmed in the patch.",
"The Redis instance used for throttling is assumed to be co-located with the MISP application; a Redis outage degrades to logging everything (fail-open), which is a design choice documented in the patch comments.",
"CVSS VA:H assumes that sustained unthrottled log writes can exhaust storage or I/O capacity sufficient to degrade or halt the MISP service; actual impact depends on deployment sizing and disk capacity."
],
"commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "The vulnerable paths are reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): an attacker simply sends repeated HTTP requests to the MISP API without an API key or with a key of the wrong length. No attack target is required (AT:N). There is no impact on confidentiality (VC:N, SC:N) or integrity (VI:N, SI:N). The availability impact is high (VA:H) because unbounded log writes can exhaust database storage, degrade query performance, and ultimately make the MISP instance unavailable. No secondary availability impact (SA:N) is evident from the patch.",
"draft": false,
"fixSummary": "The fix applies the existing hourly per-key log throttle to the two previously unguarded authentication-failure log writes. The throttle key is now derived from the client\u0027s source IP address rather than from caller-supplied input, preventing an attacker from generating unbounded Redis throttle entries. A per-request memo (stored in Configure::read(\u0027CurrentRequestAuthFailKeys\u0027)) is added to _shouldLog() to prevent duplicate log entries when beforeFilter() executes a second time via CakeErrorController on an exception, ensuring one request produces at most one log entry per key regardless of the operator\u0027s log_each_individual_auth_fail setting.",
"generatedAt": "2026-09-15T11:37:41.625192Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
"patchSummary": "In app/Controller/AppController.php: (1) The \u0027no authkey\u0027 branch in beforeFilter() now calls _shouldLog(\u0027noauthkey:\u0027 . $this-\u003eUser-\u003e_remoteIp()) before writing the log entry. (2) The \u0027incorrect length\u0027 branch in __loginByAuthKey() now calls _shouldLog(\u0027badauthkeylength:\u0027 . $this-\u003eUser-\u003e_remoteIp()) before writing the log entry. (3) _shouldLog() is refactored to first check a per-request memo array (Configure \u0027CurrentRequestAuthFailKeys\u0027) to suppress duplicate logging across the double beforeFilter() invocation, then evaluate the log_each_individual_auth_fail setting, then fall through to the Redis EXISTS/SETEX 3600-second throttle, and finally record the key in the memo. The Redis-unavailable fallback (log everything) is preserved.",
"patchTruncated": false,
"patches": [
{
"commit": "2bf8874336518d8c5ef6a42e51e78900ec242630",
"patchSha256": "db6f78e69079c91d4ba1dac46c4ed5b8ff1ca617c00cd6733bff926c0925a2e3",
"source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/2bf887433.patch",
"subject": "fix: [logging] Throttle the two unguarded auth_fail writes"
}
],
"source": "https://github.com/MISP/MISP/commit/2bf887433.patch",
"subject": "fix: [logging] Throttle the two unguarded auth_fail writes",
"tagVersionBoundary": {
"commits_after_fix": 188,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-770",
"rationale": "Two authentication-failure log write paths lacked any rate-limiting or throttling mechanism, allowing an unauthenticated remote attacker to generate an unbounded number of database log entries and exhaust storage or I/O resources. The fix adds the missing hourly per-key throttle."
},
{
"cweId": "CWE-400",
"rationale": "The unthrottled log writes constitute uncontrolled consumption of database write capacity and disk storage, enabling a denial-of-service condition. CWE-770 is the more specific primary weakness; CWE-400 captures the broader resource-exhaustion impact."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20158"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-92003",
"datePublished": "2026-09-15T11:43:19.403Z",
"dateReserved": "2026-09-15T11:43:17.522Z",
"dateUpdated": "2026-09-15T12:32:06.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91979 (GCVE-0-2026-91979)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-17 19:28
VLAI
EPSS
VEX
Title
Vikunja before 2.6.0 Denial of Service via Decompression Bomb
Summary
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0 , < 2.6.0
(semver)
Unaffected: 2.6.0 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91979",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:24.646410Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:28:09.001Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.6.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Str1ckl4nd"
},
{
"lang": "en",
"type": "reporter",
"value": "7thParkk"
},
{
"lang": "en",
"type": "reporter",
"value": "0xcelien"
},
{
"lang": "en",
"type": "reporter",
"value": "JellowBeanz26"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:18:24.176Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w7jp-mf2v-8342)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w7jp-mf2v-8342"
},
{
"name": "VulnCheck Advisory: Vikunja before 2.6.0 Denial of Service via Decompression Bomb",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-decompression-bomb"
}
],
"title": "Vikunja before 2.6.0 Denial of Service via Decompression Bomb",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91979",
"datePublished": "2026-09-15T15:18:24.176Z",
"dateReserved": "2026-09-15T11:10:41.353Z",
"dateUpdated": "2026-09-17T19:28:09.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91971 (GCVE-0-2026-91971)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-21 18:48
VLAI
EPSS
VEX
Title
Vikunja before 2.6.0 Denial of Service via Avatar Upload
Summary
Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:48 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0 , < 2.6.0
(semver)
Unaffected: 2.6.0 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91971",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:48:29.629806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:48:39.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4vh2-39rq-rq8j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.6.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Str1ckl4nd"
},
{
"lang": "en",
"type": "reporter",
"value": "7thParkk"
},
{
"lang": "en",
"type": "reporter",
"value": "JellowBeanz26"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:18:22.129Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4vh2-39rq-rq8j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4vh2-39rq-rq8j"
},
{
"name": "VulnCheck Advisory: Vikunja before 2.6.0 Denial of Service via Avatar Upload",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-avatar-upload"
}
],
"title": "Vikunja before 2.6.0 Denial of Service via Avatar Upload",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91971",
"datePublished": "2026-09-15T15:18:22.129Z",
"dateReserved": "2026-09-15T11:09:54.873Z",
"dateUpdated": "2026-09-21T18:48:39.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91969 (GCVE-0-2026-91969)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-17 19:28
VLAI
EPSS
VEX
Title
vikunja before 2.6.0 Resource Exhaustion via CSV Migration
Summary
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
2.5.0 , < 2.6.0
(semver)
Unaffected: 2.6.0 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:21.978485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:28:14.545Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.6.0",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.6.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.0",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyy0530"
},
{
"lang": "en",
"type": "reporter",
"value": "Str1ckl4nd"
},
{
"lang": "en",
"type": "reporter",
"value": "7thParkk"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:18:20.780Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pqf9-h8g4-8gmh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh"
},
{
"name": "VulnCheck Advisory: vikunja before 2.6.0 Resource Exhaustion via CSV Migration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration"
}
],
"title": "vikunja before 2.6.0 Resource Exhaustion via CSV Migration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91969",
"datePublished": "2026-09-15T15:18:20.780Z",
"dateReserved": "2026-09-15T11:09:54.872Z",
"dateUpdated": "2026-09-17T19:28:14.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91941 (GCVE-0-2026-91941)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:18 – Updated: 2026-09-20 00:35
VLAI
EPSS
VEX
Title
Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
Summary
Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-20 00:28 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/unclecode/crawl4ai/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/crawl4ai-bef… | third-party-advisory |
Impacted products
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-20T00:28:11.204154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:35:29.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/crawl4ai",
"product": "crawl4ai",
"vendor": "unclecode",
"versions": [
{
"lessThan": "0.9.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.9.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "c240030"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:18:01.763Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v2rm-hvrj-2x9q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-v2rm-hvrj-2x9q"
},
{
"name": "VulnCheck Advisory: Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-denial-of-service-via-pdfcontentscrapingstrategy"
}
],
"title": "Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91941",
"datePublished": "2026-09-15T15:18:01.763Z",
"dateReserved": "2026-09-15T11:07:01.912Z",
"dateUpdated": "2026-09-20T00:35:29.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91777 (GCVE-0-2026-91777)
Vulnerability from cvelistv5 – Published: 2026-09-23 02:21 – Updated: 2026-09-23 14:05
VLAI
EPSS
VEX
Title
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Summary
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:04 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
HeroDevs
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FasterXML/jackson-databind/sec… | vendor-advisory |
| https://github.com/FasterXML/jackson-databind/iss… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FasterXML | jackson-databind |
Affected:
2.5.0 , ≤ 2.18.10
(maven)
Affected: 2.19.0 , ≤ 2.21.6 (maven) Affected: 2.22.0 , ≤ 2.22.2 (maven) |
|
| FasterXML | jackson-databind |
Affected:
3.0.0 , ≤ 3.1.6
(maven)
Affected: 3.2.0 , ≤ 3.2.2 (maven) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91777",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:04:51.226591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:05:17.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.core:jackson-databind",
"product": "jackson-databind",
"programRoutines": [
{
"name": "com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"
},
{
"name": "com.fasterxml.jackson.databind.deser.std.MapDeserializer.MapReferringAccumulator.resolveForwardReference"
}
],
"repo": "https://github.com/FasterXML/jackson-databind",
"vendor": "FasterXML",
"versions": [
{
"lessThanOrEqual": "2.18.10",
"status": "affected",
"version": "2.5.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2.21.6",
"status": "affected",
"version": "2.19.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2.22.2",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo1.maven.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.core:jackson-databind",
"product": "jackson-databind",
"programRoutines": [
{
"name": "tools.jackson.databind.deser.jdk.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"
},
{
"name": "tools.jackson.databind.deser.jdk.MapDeserializer.MapReferringAccumulator.resolveForwardReference"
}
],
"repo": "https://github.com/FasterXML/jackson-databind",
"vendor": "FasterXML",
"versions": [
{
"lessThanOrEqual": "3.1.6",
"status": "affected",
"version": "3.0.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.2.2",
"status": "affected",
"version": "3.2.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Birtwhistle (dabirt)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eForward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.\u003c/p\u003e"
}
],
"value": "Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:21:48.323Z",
"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"shortName": "HeroDevs"
},
"references": [
{
"name": "GHSA-cxp5-3px4-pw24",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
},
{
"name": "FasterXML/jackson-databind#6204",
"tags": [
"patch"
],
"url": "https://github.com/FasterXML/jackson-databind/issues/6204"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.5.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream.\u003c/p\u003e"
}
],
"value": "Upgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.5.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream."
}
],
"title": "jackson-databind: quadratic forward-reference completion in Collection and Map deserializers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBound the size of JSON documents deserialized into @JsonIdentityInfo-enabled collections and maps, and cap the number of elements accepted for such types, so that the quadratic term cannot be driven large. Removing @JsonIdentityInfo from types reachable from attacker-influenced input avoids the code path entirely. Wall-clock timeouts on deserialization limit the impact of a single request.\u003c/p\u003e"
}
],
"value": "Bound the size of JSON documents deserialized into @JsonIdentityInfo-enabled collections and maps, and cap the number of elements accepted for such types, so that the quadratic term cannot be driven large. Removing @JsonIdentityInfo from types reachable from attacker-influenced input avoids the code path entirely. Wall-clock timeouts on deserialization limit the impact of a single request."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"assignerShortName": "HeroDevs",
"cveId": "CVE-2026-91777",
"datePublished": "2026-09-23T02:21:48.323Z",
"dateReserved": "2026-09-15T01:25:58.562Z",
"dateUpdated": "2026-09-23T14:05:17.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91776 (GCVE-0-2026-91776)
Vulnerability from cvelistv5 – Published: 2026-09-23 02:17 – Updated: 2026-09-23 14:03
VLAI
EPSS
VEX
Title
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
Summary
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:02 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
HeroDevs
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FasterXML/jackson-databind/sec… | vendor-advisory |
| https://github.com/FasterXML/jackson-databind/iss… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FasterXML | jackson-databind |
Affected:
2.0.0 , ≤ 2.18.10
(maven)
Affected: 2.19.0 , ≤ 2.21.6 (maven) Affected: 2.22.0 , ≤ 2.22.2 (maven) |
|
| FasterXML | jackson-databind |
Affected:
3.0.0 , ≤ 3.1.6
(maven)
Affected: 3.2.0 , ≤ 3.2.2 (maven) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91776",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:02:42.582789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:03:16.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.core:jackson-databind",
"product": "jackson-databind",
"programRoutines": [
{
"name": "com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"
}
],
"repo": "https://github.com/FasterXML/jackson-databind",
"vendor": "FasterXML",
"versions": [
{
"lessThanOrEqual": "2.18.10",
"status": "affected",
"version": "2.0.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2.21.6",
"status": "affected",
"version": "2.19.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2.22.2",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo1.maven.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.core:jackson-databind",
"product": "jackson-databind",
"programRoutines": [
{
"name": "tools.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"
}
],
"repo": "https://github.com/FasterXML/jackson-databind",
"vendor": "FasterXML",
"versions": [
{
"lessThanOrEqual": "3.1.6",
"status": "affected",
"version": "3.0.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.2.2",
"status": "affected",
"version": "3.2.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Birtwhistle (dabirt)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.\u003c/p\u003e"
}
],
"value": "TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T02:17:50.480Z",
"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"shortName": "HeroDevs"
},
"references": [
{
"name": "GHSA-wv8q-qhhj-9h54",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"
},
{
"name": "FasterXML/jackson-databind#6203",
"tags": [
"patch"
],
"url": "https://github.com/FasterXML/jackson-databind/issues/6203"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.0.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream.\u003c/p\u003e"
}
],
"value": "Upgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.0.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream."
}
],
"title": "jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhere the polymorphic shape allows it, avoid defaultImpl or another catch-all fallback for name-based type resolution so that unrecognized type IDs fail rather than resolving, or restrict accepted type IDs with a custom TypeIdResolver that rejects unknown names before resolution. Shortening ObjectMapper or type deserializer lifetime limits accumulation but does not eliminate it.\u003c/p\u003e"
}
],
"value": "Where the polymorphic shape allows it, avoid defaultImpl or another catch-all fallback for name-based type resolution so that unrecognized type IDs fail rather than resolving, or restrict accepted type IDs with a custom TypeIdResolver that rejects unknown names before resolution. Shortening ObjectMapper or type deserializer lifetime limits accumulation but does not eliminate it."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"assignerShortName": "HeroDevs",
"cveId": "CVE-2026-91776",
"datePublished": "2026-09-23T02:17:50.480Z",
"dateReserved": "2026-09-15T01:22:24.203Z",
"dateUpdated": "2026-09-23T14:03:16.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90928 (GCVE-0-2026-90928)
Vulnerability from cvelistv5 – Published: 2026-09-14 12:48 – Updated: 2026-09-14 14:01
VLAI
EPSS
VEX
Title
File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
Summary
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 14:00 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/filebrowser/filebrowser/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/file-browser… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| filebrowser | filebrowser |
Affected:
0 , ≤ 2.63.23
(semver)
cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90928",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T14:00:30.915269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:01:13.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/filebrowser/filebrowser/v2",
"product": "filebrowser",
"vendor": "filebrowser",
"versions": [
{
"lessThanOrEqual": "2.63.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.63.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "1diot9"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:48:24.837Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-448h-jr2h-3vhp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp"
},
{
"name": "VulnCheck Advisory: File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/file-browser-through-2.63.23-memory-exhaustion-via-subtitle-endpoint"
}
],
"title": "File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90928",
"datePublished": "2026-09-14T12:48:24.837Z",
"dateReserved": "2026-09-14T11:33:51.886Z",
"dateUpdated": "2026-09-14T14:01:13.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90927 (GCVE-0-2026-90927)
Vulnerability from cvelistv5 – Published: 2026-09-14 12:48 – Updated: 2026-09-16 14:58
VLAI
EPSS
VEX
Title
filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
Summary
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:57 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/filebrowser/filebrowser/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/filebrowser-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| filebrowser | filebrowser |
Affected:
0 , ≤ 2.63.23
(semver)
cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90927",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:57:36.614650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:58:23.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/filebrowser/filebrowser/v2",
"product": "filebrowser",
"vendor": "filebrowser",
"versions": [
{
"lessThanOrEqual": "2.63.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.63.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alham-rizvi"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:48:24.176Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-39cx-23x9-5c8p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p"
},
{
"name": "VulnCheck Advisory: filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-unbounded-websocket-message"
}
],
"title": "filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90927",
"datePublished": "2026-09-14T12:48:24.176Z",
"dateReserved": "2026-09-14T11:33:51.885Z",
"dateUpdated": "2026-09-16T14:58:23.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.