CVE-2026-71439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71439", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T16:28:51.183Z", "datePublished": "2026-08-06T20:01:04.423Z", "dateUpdated": "2026-08-07T17:09:23.203Z"}, "containers": {"cna": {"title": "Mermaid radar diagrams are vulnerable to DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-606", "lang": "en", "description": "CWE-606: Unchecked Input for Loop Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1322", "lang": "en", "description": "CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh"}, {"name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"name": "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e"}, {"name": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1"}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"version": ">= 11.6.0, < 11.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:01:04.423Z"}, "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1."}], "source": {"advisory": "GHSA-rhh3-jpg6-66xh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T15:26:10.690336Z", "id": "CVE-2026-71439", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:09:23.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71439", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T15:26:10.690336Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T15:26:19.821Z"}}], "cna": {"title": "Mermaid radar diagrams are vulnerable to DoS", "source": {"advisory": "GHSA-rhh3-jpg6-66xh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"status": "affected", "version": ">= 11.6.0, < 11.16.1"}]}], "references": [{"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh", "name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mermaid-js/mermaid/pull/8022", "name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e", "name": "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1", "name": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-606", "description": "CWE-606: Unchecked Input for Loop Condition"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1322", "description": "CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:01:04.423Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71439", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:09:23.203Z", "dateReserved": "2026-08-06T16:28:51.183Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T20:01:04.423Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mermaid", "vendor": "mermaid-js", "versions": [{"status": "affected", "version": ">= 11.6.0, < 11.16.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1."}, {"lang": "es", "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gr\u00e1ficos. Desde la versi\u00f3n 11.6.0 hasta la 11.16.1, los diagramas de radar de Mermaid permiten valores arbitrariamente grandes para el par\u00e1metro ticks, lo que puede causar un alto uso de CPU y congelar la p\u00e1gina web de renderizado o el proceso de JavaScript durante largos per\u00edodos de tiempo, potencialmente hasta que el proceso sea terminado por agotamiento de memoria. Este problema est\u00e1 solucionado en la versi\u00f3n 11.16.1."}], "id": "CVE-2026-71439", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71439", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T15:26:10.690336Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:31.023", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-606"}, {"lang": "en", "value": "CWE-1322"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mermaid: Mermaid: Denial of Service via Radar Diagrams 'ticks' parameter", "id": "2512273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512273"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1050", "details": ["Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.", "A flaw was found in Mermaid. Mermaid Radar Diagrams are susceptible to a denial of service vulnerability. A remote attacker could exploit this by providing excessively large values for the 'ticks' parameter. This can lead to high CPU usage, causing the rendering webpage or JavaScript process to freeze and potentially terminate due to memory exhaustion."], "mitigation": {"lang": "en:us", "value": "Avoid rendering untrusted Mermaid diagram content containing Radar diagrams with attacker-controlled 'ticks' parameters in the affected workbench images until the pinned mermaid dependency is upgraded to 11.16.1 or later."}, "name": "CVE-2026-71439", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-06T20:01:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71439\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71439\nhttps://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e\nhttps://github.com/mermaid-js/mermaid/pull/8022\nhttps://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh"], "statement": "Red Hat ships Mermaid embedded in the same code-server based developer workbench images: OpenShift AI's odh-workbench-codeserver-datascience-cpu-py312 workbench image and OpenShift Dev Spaces' code-rhel9 image. The bundled version (>=11.6.0,<11.16.1) exposes users who render Mermaid Radar diagrams with excessively large 'ticks' values to a client-side denial of service through high CPU usage and potential process termination.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.16.1)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "mermaid", "source": "cna", "vendor": "mermaid-js"}, "product": "mermaid", "vendor": "mermaid_project"}], "created": "2026-08-07T01:00:05.869734+00:00", "updated": "2026-08-11T02:15:03.915296+00:00", "vendors": ["mermaid_project", "mermaid_project$PRODUCT$mermaid"]}