Search
Find a vulnerability
Search criteria
2 vulnerabilities by pdeljanov
CVE-2026-15276 (GCVE-0-2026-15276)
Vulnerability from nvd – Published: 2026-07-09 22:00 – Updated: 2026-07-10 18:24
VLAI
EPSS
VEX
Title
pdeljanov Symphonia Metadata denial of service
Summary
A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377216 | vdb-entry |
| https://vuldb.com/vuln/377216/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15276 | third-party-advisory |
| https://vuldb.com/submit/852458 | third-party-advisory |
| https://github.com/pdeljanov/Symphonia/issues/508 | exploitissue-tracking |
| https://github.com/pdeljanov/Symphonia/pull/514 | issue-trackingpatch |
| https://github.com/pdeljanov/Symphonia/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15276",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T18:23:58.705896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T18:24:06.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pdeljanov:symphonia:*:*:*:*:*:*:*:*"
],
"modules": [
"Metadata Handler"
],
"product": "Symphonia",
"vendor": "pdeljanov",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:00:12.390Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377216 | pdeljanov Symphonia Metadata denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/377216"
},
{
"name": "VDB-377216 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377216/cti"
},
{
"name": "CVE-2026-15276 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15276"
},
{
"name": "Submit #852458 | Symphonia symphonia-metadata \u003c= 0.6.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852458"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/pdeljanov/Symphonia/issues/508"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/pdeljanov/Symphonia/pull/514"
},
{
"tags": [
"product"
],
"url": "https://github.com/pdeljanov/Symphonia/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-09T17:07:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "pdeljanov Symphonia Metadata denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15276",
"datePublished": "2026-07-09T22:00:12.390Z",
"dateReserved": "2026-07-09T15:02:29.634Z",
"dateUpdated": "2026-07-10T18:24:06.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15276 (GCVE-0-2026-15276)
Vulnerability from cvelistv5 – Published: 2026-07-09 22:00 – Updated: 2026-07-10 18:24
VLAI
EPSS
VEX
Title
pdeljanov Symphonia Metadata denial of service
Summary
A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377216 | vdb-entry |
| https://vuldb.com/vuln/377216/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15276 | third-party-advisory |
| https://vuldb.com/submit/852458 | third-party-advisory |
| https://github.com/pdeljanov/Symphonia/issues/508 | exploitissue-tracking |
| https://github.com/pdeljanov/Symphonia/pull/514 | issue-trackingpatch |
| https://github.com/pdeljanov/Symphonia/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15276",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T18:23:58.705896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T18:24:06.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pdeljanov:symphonia:*:*:*:*:*:*:*:*"
],
"modules": [
"Metadata Handler"
],
"product": "Symphonia",
"vendor": "pdeljanov",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:00:12.390Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377216 | pdeljanov Symphonia Metadata denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/377216"
},
{
"name": "VDB-377216 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377216/cti"
},
{
"name": "CVE-2026-15276 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15276"
},
{
"name": "Submit #852458 | Symphonia symphonia-metadata \u003c= 0.6.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852458"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/pdeljanov/Symphonia/issues/508"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/pdeljanov/Symphonia/pull/514"
},
{
"tags": [
"product"
],
"url": "https://github.com/pdeljanov/Symphonia/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-09T17:07:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "pdeljanov Symphonia Metadata denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15276",
"datePublished": "2026-07-09T22:00:12.390Z",
"dateReserved": "2026-07-09T15:02:29.634Z",
"dateUpdated": "2026-07-10T18:24:06.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}