CVE-2026-46689
0.04%V4
2026-06-10
22h17 +00:00
22h17 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3.
Informasi CVE
Kelemahan Terkait
| Nama Kelemahan | Sumber | |
|---|---|---|
| Uncaught Exception An exception is thrown from a function, but it is not caught. |
||
| Uncontrolled Resource Consumption The product does not properly control the allocation and maintenance of a limited resource. |
||
| Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
EPSS
EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.
Skor EPSS
Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.
Persentil EPSS
Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.
