CVE-2026-63462

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63462", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T21:37:45.768Z", "datePublished": "2026-08-21T18:12:32.807Z", "dateUpdated": "2026-08-25T17:33:23.689Z"}, "containers": {"cna": {"title": "Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter", "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "lang": "en", "description": "CWE-674: Uncontrolled Recursion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"}, {"name": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf"}, {"name": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"}, {"name": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2"}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"version": "< 7.5.2", "status": "affected"}, {"version": ">= 7.6.0, < 7.6.5", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:12:32.807Z"}, "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}], "source": {"advisory": "GHSA-r5pq-6chh-j3xp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T17:32:06.100866Z", "id": "CVE-2026-63462", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:33:23.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63462", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:32:06.100866Z"}}}], "references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:32:39.214Z"}}], "cna": {"title": "Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter", "source": {"advisory": "GHSA-r5pq-6chh-j3xp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"status": "affected", "version": "< 7.5.2"}, {"status": "affected", "version": ">= 7.6.0, < 7.6.5"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.2"}]}], "references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp", "name": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf", "name": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "name": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "name": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "name": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "name": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "name": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674: Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:12:32.807Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63462", "state": "PUBLISHED", "dateUpdated": "2026-08-25T17:33:23.689Z", "dateReserved": "2026-07-16T21:37:45.768Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T18:12:32.807Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "unleash", "vendor": "Unleash", "versions": [{"status": "affected", "version": "< 7.5.2"}, {"status": "affected", "version": ">= 7.6.0, < 7.6.5"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}, {"lang": "es", "value": "Unleash es una plataforma de gesti\u00f3n de caracter\u00edsticas de c\u00f3digo abierto. Antes de las versiones 7.5.2, 7.6.5 y 8.0.2, la ruta de error de validaci\u00f3n de OpenAPI compartida en src/lib/error/bad-data-error.ts pasa un valor de solicitud sin procesar de lodash.get a JSON.stringify en genericErrorMessage y fromOpenApiValidationErrors sin proteger contra el agotamiento de la pila. Un atacante no autenticado puede enviar un valor JSON de aproximadamente 10 KB anidado miles de niveles de profundidad a POST /edge/validate, POST /edge/issue-token, o a otro endpoint validado por OpenAPI, causando RangeError: Maximum call stack size exceeded en openAPIValidationMiddleware y terminando el proceso de Node porque ning\u00fan gestor de uncaughtException lo recupera. Reenviar la solicitud puede mantener una interrupci\u00f3n completa del servicio. Este problema est\u00e1 solucionado en las versiones 7.5.2, 7.6.5 y 8.0.2."}], "id": "CVE-2026-63462", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63462", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T17:32:06.100866Z", "version": "2.0.3"}}]}, "published": "2026-08-21T19:17:31.927", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.5.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,7.6.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "unleash", "source": "cna", "vendor": "Unleash"}, "product": "unleash", "vendor": "unleash"}], "created": "2026-08-21T20:00:13.885900+00:00", "updated": "2026-08-21T21:15:04.930817+00:00", "vendors": ["unleash", "unleash$PRODUCT$unleash"]}