CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

Açıklama

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-gpr6-gr9g-pfw6) vendor-advisory
• VulnCheck Advisory: Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL third-party-advisory