{"vulnerability": "CVE-2026-7149", "sightings": [{"uuid": "7484394f-c677-4cdf-806d-e0014d410f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71491", "type": "seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3mtl3njfz3o25", "content": "dbt Core v1.12.3\n\nRequire sqlparse>=0.5.5,<0.7.0 to fix CVE-2026-54284, CVE-2026-59893, CVE-2026-59894 and CVE-2026-71491 parser denial-of-service vulnerabilities", "creation_timestamp": "2026-08-21T06:03:59.615559Z"}, {"uuid": "596cd74d-b178-45cc-8b43-0228e31b0b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71491", "type": "published-proof-of-concept", "source": "Telegram/GwuC3cy-O_zU2KFCuHY_MrTkUTBOKWE1Dd5EfEUwy3SR_6M", "content": "", "creation_timestamp": "2026-08-19T00:00:28.252937Z"}, {"uuid": "047facb6-f7d2-4463-8652-df8425296f2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71491", "type": "published-proof-of-concept", "source": "Telegram/GwuC3cy-O_zU2KFCuHY_MrTkUTBOKWE1Dd5EfEUwy3SR_6M", "content": "", "creation_timestamp": "2026-08-18T01:00:04.903311Z"}, {"uuid": "7a172dce-ead0-4d02-831b-eb63a5b05e99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71498", "type": "published-proof-of-concept", "source": "https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg", "content": "", "creation_timestamp": "2026-08-06T22:35:09.780158Z"}, {"uuid": "a1bc5e43-de18-4626-9fe9-94d3d93ef8fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71498", "type": "seen", "source": "https://gist.github.com/alon710/0c61a6195ede2fd8a0ca10d8b63bbf6e", "content": "# CVE-2026-71498: CVE-2026-71498: Out-of-bounds Heap Read in node-re2 via Truncated Multi-byte UTF-8 Characters\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71498\n\n## Summary\nA medium-severity out-of-bounds (OOB) heap read vulnerability exists in node-re2 prior to version 1.26.1. When a raw binary Node.js Buffer with a truncated multi-byte UTF-8 character at its end is passed to the C++ native addon, the internal lookahead routine getUtf8CharSize() over-reads up to 3 bytes from the heap, leading to memory disclosure.\n\n## TL;DR\nPassing a raw Node.js Buffer ending in a truncated multi-byte UTF-8 byte to node-re2 (< 1.26.1) causes a 3-byte heap over-read, leaking adjacent heap memory back to the JavaScript runtime.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 (Out-of-bounds Read)\n- **Attack Vector**: Local\n- **CVSS v3.1**: 5.1 (Medium)\n- **Exploit Status**: PoC (Proof-of-Concept) documented\n- **KEV Status**: Not Listed\n- **Impact Type**: Information Disclosure / Memory Leakage\n\n## Affected Systems\n\n- node-re2 (npm package: re2) running on Node.js runtime environments\n- **re2**: < 1.26.1 (Fixed in: `1.26.1`)\n\n## Mitigation\n\n- Upgrade node-re2 (npm package: re2) to version 1.26.1 or later.\n- Sanitize Buffer inputs by casting them to standard JS UTF-8 strings before passing them to native RE2 routines.\n\n**Remediation Steps:**\n1. Open your project package.json and locate the 're2' dependency entry.\n2. Update the version identifier to '^1.26.1'.\n3. Run 'npm update re2' or 'yarn upgrade re2' to obtain the patched binaries.\n4. Optionally, wrap direct RE2 operations on buffer streams in a defensive validation layer that checks byte arrays for trailing malformed UTF-8 characters.\n\n## References\n\n- [GitHub Security Advisory GHSA-j4r3-hg7j-8chg](https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg)\n- [node-re2 GitHub Issue #272](https://github.com/uhop/node-re2/issues/272)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71498) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T05:35:28.632049Z"}, {"uuid": "85215c2a-8cfd-405e-8896-b195fed81eb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71497", "type": "seen", "source": "https://gist.github.com/alon710/b4340b7774927252fafb9cfdb5e51a49", "content": "# CVE-2026-71497: CVE-2026-71497: Parser-Browser Desynchronization leading to XSS in jsoup Sanitizer\n\n> **CVSS Score:** 4.7\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71497\n\n## Summary\njsoup is a widely used Java library for working with real-world HTML. Versions 1.14.3 up to but excluding 1.23.1 contain a Cross-Site Scripting (XSS) vulnerability. When an application configures a custom Safelist that explicitly permits certain raw-text or RCDATA elements, such as style, title, or iframe, an attacker can exploit a parser-browser desynchronization flaw to bypass sanitization. This is achieved by utilizing trailing ASCII control characters that are handled differently by the HTML5 parsing specification and Java's string normalization methods, resulting in unescaped markup execution on the client side.\n\n## TL;DR\nA parser differential between HTML5 specifications and Java's string-trimming rules in jsoup versions 1.14.3 to 1.23.0 allows unauthenticated attackers to bypass HTML sanitizers and execute arbitrary scripts in a victim's browser context.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Cross-site Scripting)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 4.7 (Medium)\n- **EPSS Score**: 0.00043\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Java Web Applications utilizing the jsoup HTML parser library versions >= 1.14.3 and < 1.23.1 with custom Safelist configurations.\n- **jsoup**: >= 1.14.3, < 1.23.1 (Fixed in: `1.23.1`)\n\n## Mitigation\n\n- Upgrade the jsoup dependency to version 1.23.1 or higher to fix the parser desynchronization.\n- Audit and restrict the use of raw-text container elements (style, title, iframe) in custom Safelist configurations.\n- Implement a robust Content Security Policy (CSP) to block the execution of inline scripts in case of a sanitizer bypass.\n\n**Remediation Steps:**\n1. Locate the project build configuration file (pom.xml for Maven, build.gradle for Gradle).\n2. Update the jsoup dependency version string to '1.23.1' or later.\n3. Review all instances of 'Safelist' within the codebase to identify custom configurations allowing raw-text elements.\n4. Deploy the upgraded application and monitor server logs for input patterns containing control characters.\n\n## References\n\n- [jsoup Security Advisory GHSA-pmhh-3w7g-xqp8](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8)\n- [jsoup Issue Tracker #2538](https://github.com/jhy/jsoup/issues/2538)\n- [jsoup Release Version 1.23.1](https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71497) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T08:33:25.745229Z"}, {"uuid": "fb3ff7d5-41f6-4492-a253-c66f5f1f473c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71492", "type": "published-proof-of-concept", "source": "https://github.com/masci/banks/security/advisories/GHSA-x8wg-4xgc-vr54", "content": "", "creation_timestamp": "2026-09-02T16:35:33.760006Z"}]}