https://vulnerability.circl.lu/sightings/feed 2026-08-23T12:23:38.652619+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c23fee24-4a4f-412f-ad95-0973d340837d/export 2026-08-23T12:23:38.672035+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c23fee24-4a4f-412f-ad95-0973d340837d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63462", "type": "seen", "source": "https://gist.github.com/alon710/31e18879d387aa16512f599cadd2f7a1", "content": "# CVE-2026-63462: CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63462\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Unleash server with a single ~10 KB nested JSON request, causing immediate and complete denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept available\n- **Impact**: Complete Denial of Service (DoS)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Unleash feature management server\n- **Unleash Server**: < 7.5.2 (Fixed in: `7.5.2`)\n- **Unleash Server**: >= 7.6.0, < 7.6.5 (Fixed in: `7.6.5`)\n- **Unleash Server**: >= 8.0.0, < 8.0.2 (Fixed in: `8.0.2`)\n\n## Mitigation\n\n- Upgrade Unleash platform to non-vulnerable release branches\n- Deploy Edge/WAF structural validation rules restricting JSON nesting depth\n- Configure process supervisors to automatically restart terminated Node.js processes\n\n**Remediation Steps:**\n1. Analyze package.json to identify instances of unleash-server falling within affected ranges (< 7.5.2, 7.6.0-7.6.4, 8.0.0-8.0.1)\n2. Update unleash-server dependency to v7.5.2, v7.6.5, or v8.0.2\n3. Rebuild and redeploy the containerized application\n4. Verify recovery mechanics by validating that systemd or Kubernetes restart policies are active\n\n## References\n\n- [GHSA Security Advisory](https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp)\n- [NVD CVE-2026-63462 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-63462)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-63462)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63462) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T12:31:57.212217Z"} 2026-08-22T12:31:57.212217+00:00 https://vulnerability.circl.lu/sighting/94648b50-27b2-4e86-8e39-275885ab2158/export 2026-08-23T12:23:38.674747+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "94648b50-27b2-4e86-8e39-275885ab2158", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63462", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmkfxyxt722", "content": "\ud83d\udfe0 CVE-2026-63462 - High (7.5)\n\nUnleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shar...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63462/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T20:00:52.833049Z"} 2026-08-21T20:00:52.833049+00:00