Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
6485 vulnerabilities reference this CWE, most recent first.
CVE-2026-108768 (GCVE-0-2026-108768)
Vulnerability from cvelistv5 – Published: 2026-10-11 18:59 – Updated: 2026-10-11 18:59
VLAI
EPSS
VEX
Title
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
Summary
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416550 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416550/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108768 | third-party-advisory |
| https://vuldb.com/submit/958026 | third-party-advisory |
| https://github.com/lche511/cve/tree/main/CowAgent… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"
],
"modules": [
"Streaming Tool-Call Argument Handler"
],
"product": "CowAgent",
"vendor": "zhayujie",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pengguogood (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T18:59:38.491Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416550 | zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416550"
},
{
"name": "VDB-416550 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416550/cti"
},
{
"name": "CVE-2026-108768 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108768"
},
{
"name": "Submit #958026 | zhayujie CowAgent 2.1.6 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/958026"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lche511/cve/tree/main/CowAgent_Tool_Call_Arguments_JSON_Repair_DoS_Report"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T09:25:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108768",
"datePublished": "2026-10-11T18:59:38.491Z",
"dateReserved": "2026-10-11T07:20:26.021Z",
"dateUpdated": "2026-10-11T18:59:38.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108683 (GCVE-0-2026-108683)
Vulnerability from cvelistv5 – Published: 2026-10-11 14:30 – Updated: 2026-10-11 14:30 X_Open Source
VLAI
EPSS
VEX
Title
zhayujie CowAgent Media Download memory allocation
Summary
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416391 | vdb-entry |
| https://vuldb.com/vuln/416391/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108683 | third-party-advisory |
| https://vuldb.com/submit/958015 | third-party-advisory |
| https://github.com/lche511/cve/tree/main/CowAgent… | exploit |
| https://github.com/zhayujie/CowAgent/commit/b7967… | patch |
| https://github.com/zhayujie/CowAgent/releases/tag/2.2.0 | patch |
| https://github.com/zhayujie/CowAgent/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"
],
"modules": [
"Media Download Handler"
],
"product": "CowAgent",
"vendor": "zhayujie",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pengguogood (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T14:30:23.145Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416391 | zhayujie CowAgent Media Download memory allocation",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/416391"
},
{
"name": "VDB-416391 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416391/cti"
},
{
"name": "CVE-2026-108683 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108683"
},
{
"name": "Submit #958015 | zhayujie CowAgent 2.1.6 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/958015"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Report"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/releases/tag/2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/zhayujie/CowAgent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-10T23:27:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "zhayujie CowAgent Media Download memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108683",
"datePublished": "2026-10-11T14:30:23.145Z",
"dateReserved": "2026-10-10T21:22:18.046Z",
"dateUpdated": "2026-10-11T14:30:23.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108577 (GCVE-0-2026-108577)
Vulnerability from cvelistv5 – Published: 2026-10-11 12:30 – Updated: 2026-10-11 12:30
VLAI
EPSS
VEX
Title
Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption
Summary
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416234 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416234/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108577 | third-party-advisory |
| https://vuldb.com/submit/956556 | third-party-advisory |
| https://vuldb.com/submit/956555 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Konstanty Bialkowski | libmodplug |
Affected:
0.8.9.0
Affected: 0.8.9.1 cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:*"
],
"modules": [
"ABC Music Format Parser"
],
"product": "libmodplug",
"vendor": "Konstanty Bialkowski",
"versions": [
{
"status": "affected",
"version": "0.8.9.0"
},
{
"status": "affected",
"version": "0.8.9.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jenseny20 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:30:10.914Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416234 | Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416234"
},
{
"name": "VDB-416234 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416234/cti"
},
{
"name": "CVE-2026-108577 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108577"
},
{
"name": "Submit #956556 | Konstanty\uff08Konstanty Bialkowski\uff0c github.com/Konstanty/libmod\uff09 libmodplug 0.8.9.0 CWE-400 Uncontrolled Resource Consumption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/956556"
},
{
"name": "Submit #956555 | Konstanty\uff08Konstanty Bialkowski\uff0c\u4e0a\u6e38\u4ed3\u5e93 github.com/Konstanty/libmodp libmodplug 0.8.9.0 \u8d44\u6e90\u8017\u5c3d (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/956555"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-10T17:54:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108577",
"datePublished": "2026-10-11T12:30:10.914Z",
"dateReserved": "2026-10-10T15:48:56.120Z",
"dateUpdated": "2026-10-11T12:30:10.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108545 (GCVE-0-2026-108545)
Vulnerability from cvelistv5 – Published: 2026-10-10 14:15 – Updated: 2026-10-10 14:15
VLAI
EPSS
VEX
Title
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
Summary
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/sillytavern-preauth-body… | technical-descriptionexploit |
| https://github.com/SillyTavern/SillyTavern | product |
| https://github.com/SillyTavern/SillyTavern/blob/1… | technical-description |
| https://www.vulncheck.com/advisories/sillytavern-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SillyTavern | SillyTavern |
Affected:
1.12.13 , ≤ 1.19.0
(semver)
cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:*:*:* |
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/SillyTavern/SillyTavern",
"product": "SillyTavern",
"repo": "https://github.com/SillyTavern/SillyTavern",
"vendor": "SillyTavern",
"versions": [
{
"lessThanOrEqual": "1.19.0",
"status": "affected",
"version": "1.12.13",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.19.0",
"versionStartIncluding": "1.12.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T14:15:52.273Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind/sillytavern-preauth-body-parser-dos"
},
{
"tags": [
"product"
],
"url": "https://github.com/SillyTavern/SillyTavern"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SillyTavern/SillyTavern/blob/1.19.0/src/server-main.js#L110-L150"
},
{
"name": "VulnCheck Advisory: SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sillytavern-1.12.13-through-1.19.0-pre-authentication-denial-of-service-via-body-parsing"
}
],
"title": "SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108545",
"datePublished": "2026-10-10T14:15:52.273Z",
"dateReserved": "2026-10-10T14:06:53.389Z",
"dateUpdated": "2026-10-10T14:15:52.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107840 (GCVE-0-2026-107840)
Vulnerability from cvelistv5 – Published: 2026-10-09 18:08 – Updated: 2026-10-09 19:25
VLAI
EPSS
VEX
Title
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
Summary
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 19:25 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/jhaals/yopass/security/advisor… | x_refsource_CONFIRM |
| https://github.com/jhaals/yopass/pull/3773 | x_refsource_MISC |
| https://github.com/jhaals/yopass/commit/61e31ead0… | x_refsource_MISC |
| https://github.com/jhaals/yopass/commit/78d0c14f7… | x_refsource_MISC |
| https://github.com/jhaals/yopass/releases/tag/14.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T19:25:13.327928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T19:25:28.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yopass",
"vendor": "jhaals",
"versions": [
{
"status": "affected",
"version": "\u003c 14.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T18:08:29.059Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m"
},
{
"name": "https://github.com/jhaals/yopass/pull/3773",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jhaals/yopass/pull/3773"
},
{
"name": "https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf"
},
{
"name": "https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb"
},
{
"name": "https://github.com/jhaals/yopass/releases/tag/14.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jhaals/yopass/releases/tag/14.7.0"
}
],
"source": {
"advisory": "GHSA-6r69-c6wg-7g8m",
"discovery": "UNKNOWN"
},
"title": "yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107840",
"datePublished": "2026-10-09T18:08:29.059Z",
"dateReserved": "2026-10-08T22:34:49.290Z",
"dateUpdated": "2026-10-09T19:25:28.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107839 (GCVE-0-2026-107839)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:58 – Updated: 2026-10-09 17:58
VLAI
EPSS
VEX
Title
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
Summary
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/luskaner/ageLANServer/security… | x_refsource_CONFIRM |
| https://github.com/luskaner/ageLANServer/commit/1… | x_refsource_MISC |
| https://github.com/luskaner/ageLANServer/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| luskaner | ageLANServer |
Affected:
< 1.15.2
|
{
"containers": {
"cna": {
"affected": [
{
"product": "ageLANServer",
"vendor": "luskaner",
"versions": [
{
"status": "affected",
"version": "\u003c 1.15.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:58:09.801Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/luskaner/ageLANServer/security/advisories/GHSA-4jfq-pmq9-257h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/luskaner/ageLANServer/security/advisories/GHSA-4jfq-pmq9-257h"
},
{
"name": "https://github.com/luskaner/ageLANServer/commit/1dd40166a59356865c0a4b1800f32d05dc8bec79",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/luskaner/ageLANServer/commit/1dd40166a59356865c0a4b1800f32d05dc8bec79"
},
{
"name": "https://github.com/luskaner/ageLANServer/releases/tag/v1.15.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/luskaner/ageLANServer/releases/tag/v1.15.2"
}
],
"source": {
"advisory": "GHSA-4jfq-pmq9-257h",
"discovery": "UNKNOWN"
},
"title": "ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107839",
"datePublished": "2026-10-09T17:58:09.801Z",
"dateReserved": "2026-10-08T22:34:49.290Z",
"dateUpdated": "2026-10-09T17:58:09.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107834 (GCVE-0-2026-107834)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:41 – Updated: 2026-10-09 17:41
VLAI
EPSS
VEX
Title
OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
Summary
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.
Severity
5.3 (Medium)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/corazawaf/coraza/security/advi… | x_refsource_CONFIRM |
| https://github.com/corazawaf/coraza/commit/1bc390… | x_refsource_MISC |
| https://github.com/corazawaf/coraza/releases/tag/v3.8.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coraza",
"vendor": "corazawaf",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772: Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:41:07.802Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/corazawaf/coraza/security/advisories/GHSA-rp9v-7xv3-r6g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-rp9v-7xv3-r6g3"
},
{
"name": "https://github.com/corazawaf/coraza/commit/1bc39036e99c88e7de60cf8e6bb55ee4c311223c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/commit/1bc39036e99c88e7de60cf8e6bb55ee4c311223c"
},
{
"name": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0"
}
],
"source": {
"advisory": "GHSA-rp9v-7xv3-r6g3",
"discovery": "UNKNOWN"
},
"title": "OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107834",
"datePublished": "2026-10-09T17:41:07.802Z",
"dateReserved": "2026-10-08T22:34:49.289Z",
"dateUpdated": "2026-10-09T17:41:07.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107805 (GCVE-0-2026-107805)
Vulnerability from cvelistv5 – Published: 2026-10-09 14:50 – Updated: 2026-10-09 14:50
VLAI
EPSS
VEX
Title
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Summary
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/0xJacky/nginx-ui/security/advi… | x_refsource_CONFIRM |
| https://github.com/0xJacky/nginx-ui/commit/8c9b9a… | x_refsource_MISC |
| https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "nginx-ui",
"vendor": "0xJacky",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T14:50:58.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-j3hg-9rp3-5hw9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-j3hg-9rp3-5hw9"
},
{
"name": "https://github.com/0xJacky/nginx-ui/commit/8c9b9a1aff218ee6c980d047b750e49da3c46796",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/0xJacky/nginx-ui/commit/8c9b9a1aff218ee6c980d047b750e49da3c46796"
},
{
"name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0"
}
],
"source": {
"advisory": "GHSA-j3hg-9rp3-5hw9",
"discovery": "UNKNOWN"
},
"title": "Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107805",
"datePublished": "2026-10-09T14:50:58.011Z",
"dateReserved": "2026-10-08T21:23:59.820Z",
"dateUpdated": "2026-10-09T14:50:58.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107727 (GCVE-0-2026-107727)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:11 – Updated: 2026-10-08 22:11
VLAI
EPSS
VEX
Title
Strawberry legacy graphql-ws retains naturally completed subscription slots
Summary
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/strawberry-graphql/strawberry/… | x_refsource_CONFIRM |
| https://github.com/strawberry-graphql/strawberry/… | x_refsource_MISC |
| https://github.com/strawberry-graphql/strawberry/… | x_refsource_MISC |
| https://github.com/strawberry-graphql/strawberry/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| strawberry-graphql | strawberry |
Affected:
>= 0.312.3, < 0.327.2
|
{
"containers": {
"cna": {
"affected": [
{
"product": "strawberry",
"vendor": "strawberry-graphql",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.312.3, \u003c 0.327.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection\u0027s configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:11:12.785Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-m952-2w3f-6r8h"
},
{
"name": "https://github.com/strawberry-graphql/strawberry/pull/4610",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/strawberry-graphql/strawberry/pull/4610"
},
{
"name": "https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/strawberry-graphql/strawberry/commit/24c5e46d57f7ad4f77e6e01fb8ae482dd1c0ff92"
},
{
"name": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.327.2"
}
],
"source": {
"advisory": "GHSA-m952-2w3f-6r8h",
"discovery": "UNKNOWN"
},
"title": "Strawberry legacy graphql-ws retains naturally completed subscription slots"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107727",
"datePublished": "2026-10-08T22:11:12.785Z",
"dateReserved": "2026-10-08T17:21:52.976Z",
"dateUpdated": "2026-10-08T22:11:12.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107392 (GCVE-0-2026-107392)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:13 – Updated: 2026-10-08 19:53
VLAI
EPSS
VEX
Title
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
Summary
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 19:53 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Borewit/music-metadata/securit… | x_refsource_CONFIRM |
| https://github.com/Borewit/music-metadata/pull/2700 | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/commit/… | x_refsource_MISC |
| https://github.com/Borewit/music-metadata/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Borewit | music-metadata |
Affected:
< 11.15.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107392",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T19:53:02.846447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:53:23.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "music-metadata",
"vendor": "Borewit",
"versions": [
{
"status": "affected",
"version": "\u003c 11.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:13:06.392Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j"
},
{
"name": "https://github.com/Borewit/music-metadata/pull/2700",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/pull/2700"
},
{
"name": "https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41"
},
{
"name": "https://github.com/Borewit/music-metadata/releases/tag/v11.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.15.0"
}
],
"source": {
"advisory": "GHSA-8j4c-6x6g-rq3j",
"discovery": "UNKNOWN"
},
"title": "music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107392",
"datePublished": "2026-10-08T19:13:06.392Z",
"dateReserved": "2026-10-07T21:07:54.989Z",
"dateUpdated": "2026-10-08T19:53:23.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.