IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.7Hoch

CVE-2026-3304Multer vulnerable to Denial of Service via incomplete cleanup

expressjs multer; Red Hat Red Hat Developer Hub 1.8; Red Hat Red Hat Developer Hub 1.9; Red Hat Logging Subsystem for Red Hat OpenShift Veröffentlicht: (vor 8 Monaten)

Beschreibung

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

Schwachstellentyp (CWE): CWE-459

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
expressjs multer 0.0.0 – < 2.1.0
Red Hat Logging Subsystem for Red Hat OpenShift —
Red Hat Red Hat Developer Hub 1.8 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Trusted Profile Analyzer —
Red Hat Self-service automation portal 2 all versions
rhdh 1.8 —
rhdh 1.9 —

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:* < 2.1.0

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

5.5Mittel
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Hoch
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…