IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-09 09:16

MODIFIED

2026-06-09 09:16

EPSS (Prob. Exploit)

0.65%

Top 49.3%

DATA SOURCES:

NVD 🔗 2026-06-09 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-434

> CWE DETAILED DESCRIPTIONS

CWE-434: Unrestricted Upload of File with Dangerous Type - The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

> GITHUB SECURITY ADVISORY

GHSA-v553-g2w6-295p MODERATE

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

AFFECTED PACKAGES:

GO / github.com/apache/incubator-answer

< 1.7.2-0.20260325113131-cfc3e54f30cc

Fixed in: 1.7.2-0.20260325113131-cfc3e54f30cc

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/06/2026 09:16

Source: NVD

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-434: Unrestricted Upload of File with Dangerous Type - The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z4st1kbq