CVE-2026-121820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121820", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2026-11-04T05:50:04.721Z", "datePublished": "2026-11-06T07:46:48.261Z", "dateUpdated": "2026-11-10T17:24:41.043Z"}, "containers": {"cna": {"affected": [{"vendor": "LY Corporation", "product": "Armeria", "defaultStatus": "affected", "versions": [{"version": "1.43.0", "status": "unaffected", "versionType": "custom", "lessThan": "*"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service."}], "references": [{"url": "https://line.github.io/security-advisory-blog/CVE-2026-121820/"}, {"url": "https://github.com/line/armeria/security/advisories/GHSA-6hgp-j5h7-33m3"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.7, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-11-06T07:46:48.261Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T17:24:04.893375Z", "id": "CVE-2026-121820", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T17:24:41.043Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T17:24:04.893375Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T17:24:18.346Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "LY Corporation", "product": "Armeria", "versions": [{"status": "unaffected", "version": "1.43.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://line.github.io/security-advisory-blog/CVE-2026-121820/"}, {"url": "https://github.com/line/armeria/security/advisories/GHSA-6hgp-j5h7-33m3"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-409"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2026-11-06T07:46:48.261Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121820", "state": "PUBLISHED", "dateUpdated": "2026-11-10T17:24:41.043Z", "dateReserved": "2026-11-04T05:50:04.721Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2026-11-06T07:46:48.261Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Armeria", "vendor": "LY Corporation", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.43.0", "versionType": "custom"}]}], "source": "dl_cve@linecorp.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service."}], "id": "CVE-2026-121820", "lastModified": "2026-11-10T18:17:20.953", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dl_cve@linecorp.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121820", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T17:24:04.893375Z", "version": "2.0.3"}}]}, "published": "2026-11-06T08:17:20.410", "references": [{"source": "dl_cve@linecorp.com", "url": "https://github.com/line/armeria/security/advisories/GHSA-6hgp-j5h7-33m3"}, {"source": "dl_cve@linecorp.com", "url": "https://line.github.io/security-advisory-blog/CVE-2026-121820/"}], "sourceIdentifier": "dl_cve@linecorp.com", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "com.linecorp.armeria/armeria-saml: armeria-saml: Denial of Service via decompression of untrusted SAML messages", "id": "2568048", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568048"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-409", "details": ["A flaw was found in armeria-saml. The HTTP-Redirect binding decoder decompresses incoming Security Assertion Markup Language (SAML) messages without restricting the maximum uncompressed size before validating signatures. An unauthenticated remote attacker can exploit this issue by sending a specially crafted compressed message, leading to server memory exhaustion and a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121820", "public_date": "2026-11-06T07:46:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121820"], "statement": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust system resources and trigger a denial of service without requiring prior privileges or victim interaction. In typical deployments, exposure is limited to network services configured to parse inbound SAML HTTP-Redirect authentication requests. Because decompression occurs before cryptographic verification, systems that expose this endpoint to untrusted networks can be rendered unavailable by malformed compressed payloads.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.43.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Armeria", "source": "cna", "vendor": "LY Corporation"}, "product": "armeria", "vendor": "ly_corporation"}], "created": "2026-11-06T09:30:08.595816+00:00", "updated": "2026-11-06T15:45:05.026281+00:00", "vendors": ["ly_corporation", "ly_corporation$PRODUCT$armeria"]}