CVE-2026-109954Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

Beschreibung

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-jhh9-hrgh-c9gv) vendor-advisory
• VulnCheck Advisory: Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference third-party-advisory