CVE-2026-27807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27807", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:31:33.267Z", "datePublished": "2026-03-06T02:48:28.384Z", "dateUpdated": "2026-03-06T16:10:43.887Z"}, "containers": {"cna": {"title": "MarkUs: YAML alias (\u2018billion laughs\u2019) DoS in config upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-776", "lang": "en", "description": "CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6"}, {"name": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4"}], "affected": [{"vendor": "MarkUsProject", "product": "Markus", "versions": [{"version": "< 2.9.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T02:48:28.384Z"}, "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4."}], "source": {"advisory": "GHSA-m9rx-85mx-q9h6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:50:49.801664Z", "id": "CVE-2026-27807", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:10:43.887Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T15:50:49.801664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:50:50.844Z"}}], "cna": {"title": "MarkUs: YAML alias (\u2018billion laughs\u2019) DoS in config upload", "source": {"advisory": "GHSA-m9rx-85mx-q9h6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "MarkUsProject", "product": "Markus", "versions": [{"status": "affected", "version": "< 2.9.4"}]}], "references": [{"url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6", "name": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4", "name": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-776", "description": "CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T02:48:28.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27807", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:10:43.887Z", "dateReserved": "2026-02-24T02:31:33.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T02:48:28.384Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Markus", "vendor": "MarkUsProject", "versions": [{"status": "affected", "version": "< 2.9.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*", "matchCriteriaId": "68B46CED-C806-4F2A-B1C6-727EE540E7A2", "versionEndExcluding": "2.9.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4."}, {"lang": "es", "value": "MarkUs es una aplicaci\u00f3n web para la entrega y calificaci\u00f3n de tareas de estudiantes. Antes de la versi\u00f3n 2.9.4, MarkUs permite a los instructores del curso cargar archivos YAML para crear/actualizar varias entidades (por ejemplo, configuraciones de tareas). Estos archivos YAML se analizan con alias habilitados. Este problema ha sido parcheado en la versi\u00f3n 2.9.4."}], "id": "CVE-2026-27807", "lastModified": "2026-06-17T10:27:43.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27807", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:50:49.801664Z", "version": "2.0.3"}}]}, "published": "2026-03-06T04:16:07.810", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-776"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.9.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Markus", "source": "cna", "vendor": "MarkUsProject"}, "product": "markus", "vendor": "markusproject"}], "analysis": {"en": {"generated_at": "2026-04-18T09:50:46.030969+00:00", "value": {"mitigation_remediation": ["Upgrade MarkUs to version 2.9.4 or newer to apply the vendor patch", "Restrict the YAML upload endpoint so that only verified instructor accounts can access it and enforce strict authentication checks", "Configure the application or web server to impose file size limits and validate YAML content before parsing to mitigate large or complex payloads"], "summary": {"action": "Patch immediately", "impact": "Denial of Service via YAML alias expansion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the MarkUsProject:Markus application using a version earlier than 2.9.4. Any deployment that allows instructors to upload configuration YAML files is subject to this issue until the patch is applied in version 2.9.4 or any later release.", "description_and_impact": "MarkUs is a web application used for student assignment submission and grading. In versions prior to 2.9.4, it permits course instructors to upload YAML files that are parsed with alias support enabled. An attacker can craft a YAML document that employs the \u2018billion laughs\u2019 alias technique to cause the parser to recursively expand aliases, creating an exponentially large data structure that exhausts server memory and CPU resources. The result is a denial of service that can render the web application unresponsive or force it to crash, directly impacting assignment management and potentially delaying grading procedures.", "risk_and_exploitability": "The CVSS base score of 4.9 indicates a medium severity. The EPSS score of less than 1% suggests a low likelihood of real\u2011world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires authenticated access to the instructor file\u2011upload endpoint, so the likely attack vector is an authenticated remote attacker who holds instructor privileges. By uploading a malicious YAML file that triggers alias expansion, the attacker would consume server resources and cause a denial of service."}}}}, "created": "2026-03-06T14:56:12.424099+00:00", "updated": "2026-04-18T10:00:10.317906+00:00", "vendors": ["markusproject", "markusproject$PRODUCT$markus"]}