Vulnerability-Lookup

CVE-2026-33508 (GCVE-0-2026-33508)

Vulnerability from cvelistv5 – Published: 2026-03-24 18:21 – Updated: 2026-03-25 14:28

Title

Parse Server: LiveQuery subscription query depth bypass

Summary

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-25 13:57 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7613 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/parse-community/parse-server/s…	x_refsource_CONFIRM
https://github.com/parse-community/parse-server/p…	x_refsource_MISC
https://github.com/parse-community/parse-server/p…	x_refsource_MISC
https://github.com/parse-community/parse-server/c…	x_refsource_MISC
https://github.com/parse-community/parse-server/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
parse-community	parse-server	Affected: < 8.6.56 Affected: >= 9.0.0, < 9.6.0-alpha.45	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:57:12.645634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T14:28:29.657Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "parse-server",
          "vendor": "parse-community",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.6.56"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.6.0-alpha.45"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server\u0027s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T18:21:08.477Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
        },
        {
          "name": "https://github.com/parse-community/parse-server/pull/10259",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/parse-community/parse-server/pull/10259"
        },
        {
          "name": "https://github.com/parse-community/parse-server/pull/10260",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/parse-community/parse-server/pull/10260"
        },
        {
          "name": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
        },
        {
          "name": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
        }
      ],
      "source": {
        "advisory": "GHSA-6qh5-m6g3-xhq6",
        "discovery": "UNKNOWN"
      },
      "title": "Parse Server: LiveQuery subscription query depth bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33508",
    "datePublished": "2026-03-24T18:21:08.477Z",
    "dateReserved": "2026-03-20T16:59:08.889Z",
    "dateUpdated": "2026-03-25T14:28:29.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33508",
      "date": "2026-10-20",
      "epss": "0.0062",
      "percentile": "0.48749"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "parse-server",
                "vendor": "parse-community",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 8.6.56"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 9.0.0, \u003c 9.6.0-alpha.45"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "2668F1B7-6AD2-4C60-8833-73C25404B979",
                    "versionEndExcluding": "8.6.56",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A",
                    "versionEndExcluding": "9.6.0",
                    "versionStartIncluding": "9.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*",
                    "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*",
                    "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*",
                    "matchCriteriaId": "B84C28F8-AADE-41BB-A0EF-B701AB57DC3A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7567BB81-7837-4265-B792-6A9B73CECF93",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:*",
                    "matchCriteriaId": "0035C6F1-21B9-42D1-BE29-690905F3558C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:*",
                    "matchCriteriaId": "623FB30A-0693-4449-80FA-16D36B1BE66C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:*",
                    "matchCriteriaId": "9B420167-CD3E-45A7-AD9A-0F83AEC634BA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:*",
                    "matchCriteriaId": "030A8626-DBBD-4BF2-B362-79B44FB1204D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D38CFCC3-2AA9-4C8E-9064-FE97E6E8C45C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:*",
                    "matchCriteriaId": "65BB78F2-3A1A-4CD1-B8A8-4AB043B5CA50",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*",
                    "matchCriteriaId": "EDC98AF7-8620-4A25-9BE5-623672599677",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:*",
                    "matchCriteriaId": "23E28E0F-9379-4628-B9DC-8C94A45902CF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:*",
                    "matchCriteriaId": "6631BE51-74FB-40C0-9E91-0EDF2DCADD7A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:*",
                    "matchCriteriaId": "8B0E4254-14A3-4EB6-9E98-CF45EB08B17F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:*",
                    "matchCriteriaId": "0FF63FDE-75F5-44B6-A958-CF653D84D3B4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:*",
                    "matchCriteriaId": "252B812D-A162-41C1-91CD-08D0CBAC5C46",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:*",
                    "matchCriteriaId": "421691EA-F55A-4738-8ABD-74B53B6DF155",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:*",
                    "matchCriteriaId": "5E7FAB59-142E-4191-9A6F-0744D810CD81",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:*",
                    "matchCriteriaId": "B010F310-05A1-48AE-B002-8F4C7FA62EB3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4D3B2C32-16D8-415B-A49F-060ECE8F0F33",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:*",
                    "matchCriteriaId": "43BE83C2-C756-4A5A-A340-B7D1FB52078D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*",
                    "matchCriteriaId": "DF340605-8CC8-4543-9F5D-E8602D258CED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:*",
                    "matchCriteriaId": "702EBB22-3E9F-4CBE-B855-2E3642C530B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7C17AD66-684F-4662-AF16-838FF05F47D5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:*",
                    "matchCriteriaId": "13C25963-CAE7-49AA-A941-254DCE289E35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:*",
                    "matchCriteriaId": "B6BF0C2F-DD2B-4864-961F-CA808EF22633",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:*",
                    "matchCriteriaId": "8FBB21E9-CB73-4CB1-841A-D1C08167DB51",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4CD55F0B-D854-43D4-A0F5-F83386DB24C9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:*",
                    "matchCriteriaId": "1097E8DF-3D0E-47C6-882D-E37B22119538",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:*",
                    "matchCriteriaId": "8C60F121-1C0B-4EB5-87EF-F1BED070C13B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:*",
                    "matchCriteriaId": "04D8514D-CC66-4E6B-90C8-6108F0DAA661",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4BB65A73-7BB7-42E4-97A3-4D6305172E05",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*",
                    "matchCriteriaId": "A052DFCA-EDCC-43D7-82C7-E5311F6F7687",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:*",
                    "matchCriteriaId": "192A78FB-E141-4F14-8C4A-20A4118B01C9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:*",
                    "matchCriteriaId": "CA4FEA42-4240-42B1-A5C2-6F74CBBACB92",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7192B894-2616-4852-850B-39CF6FCAC4F1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:*",
                    "matchCriteriaId": "3323535E-C323-4FD9-81E9-8F7A045EDD59",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44:*:*:*:node.js:*:*",
                    "matchCriteriaId": "20A0CF2D-C8C0-4972-8F2B-02B67C171CA2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*",
                    "matchCriteriaId": "12B11714-B961-4330-B241-FC5AF94FDBE8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:*",
                    "matchCriteriaId": "37A7C42B-4986-4BB6-BB27-0324A9AA1CFF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C793834B-64B4-4DE9-BD7D-79B52C30C34E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7AD455C8-88BE-4A0A-B33D-3A7811FFB753",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:*",
                    "matchCriteriaId": "26C475A2-997C-4C3A-8CB6-04AB3534BBC3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server\u0027s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45."
          },
          {
            "lang": "es",
            "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.56 y 9.6.0-alpha.45, el componente LiveQuery de Parse Server no aplica la configuraci\u00f3n requestComplexity.queryDepth al procesar solicitudes de suscripci\u00f3n WebSocket. Un atacante puede enviar una suscripci\u00f3n con operadores l\u00f3gicos profundamente anidados, causando recursi\u00f3n excesiva y consumo de CPU que degrada o interrumpe la disponibilidad del servicio. Este problema ha sido parcheado en las versiones 8.6.56 y 9.6.0-alpha.45."
          }
        ],
        "id": "CVE-2026-33508",
        "lastModified": "2026-06-17T10:37:37.370",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33508",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:57:12.645634Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-24T19:16:54.220",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/parse-community/parse-server/pull/10259"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/parse-community/parse-server/pull/10260"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T07:37:41+00:00",
      "cve": "CVE-2026-33508",
      "id": "CVE-2026-33508",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Parse Server: LiveQuery subscription query depth bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33508.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33508",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-25T13:57:12.645634Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-25T13:57:16.414Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "parse-server",
              "vendor": "parse-community",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 8.6.56"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 9.0.0, \u003c 9.6.0-alpha.45"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server\u0027s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-674",
                  "description": "CWE-674: Uncontrolled Recursion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-24T18:21:08.477Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
            },
            {
              "name": "https://github.com/parse-community/parse-server/pull/10259",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/parse-community/parse-server/pull/10259"
            },
            {
              "name": "https://github.com/parse-community/parse-server/pull/10260",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/parse-community/parse-server/pull/10260"
            },
            {
              "name": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
            },
            {
              "name": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
            }
          ],
          "source": {
            "advisory": "GHSA-6qh5-m6g3-xhq6",
            "discovery": "UNKNOWN"
          },
          "title": "Parse Server: LiveQuery subscription query depth bypass"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-33508",
        "datePublished": "2026-03-24T18:21:08.477Z",
        "dateReserved": "2026-03-20T16:59:08.889Z",
        "dateUpdated": "2026-03-25T14:28:29.657Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-parse-2026-33508

Vulnerability from bitnami_vulndb

Published

2026-03-27 07:14

Modified

2026-09-08 08:34

Summary

Parse Server: LiveQuery subscription query depth bypass

Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "parse",
        "purl": "pkg:bitnami/parse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.56"
            },
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33508"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "High"
  },
  "details": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0, Parse Server\u0027s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0",
  "id": "BIT-parse-2026-33508",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-03-27T07:14:33.818Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
    },
    {
      "type": "FIX",
      "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/parse-community/parse-server/pull/10259"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/parse-community/parse-server/pull/10260"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33508"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Parse Server: LiveQuery subscription query depth bypass"
}

FKIE_CVE-2026-33508

Vulnerability from fkie_nvd - Published: 2026-03-24 19:16 - Updated: 2026-06-17 10:37

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899	Patch
security-advisories@github.com	https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b	Patch
security-advisories@github.com	https://github.com/parse-community/parse-server/pull/10259	Issue Tracking
security-advisories@github.com	https://github.com/parse-community/parse-server/pull/10260	Issue Tracking
security-advisories@github.com	https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6	Vendor Advisory

Impacted products

Vendor	Product	Version
parseplatform	parse-server	*
parseplatform	parse-server	*
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0
parseplatform	parse-server	9.6.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "parse-server",
          "vendor": "parse-community",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.6.56"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.6.0-alpha.45"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "2668F1B7-6AD2-4C60-8833-73C25404B979",
              "versionEndExcluding": "8.6.56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A",
              "versionEndExcluding": "9.6.0",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*",
              "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*",
              "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*",
              "matchCriteriaId": "B84C28F8-AADE-41BB-A0EF-B701AB57DC3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:*",
              "matchCriteriaId": "7567BB81-7837-4265-B792-6A9B73CECF93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:*",
              "matchCriteriaId": "0035C6F1-21B9-42D1-BE29-690905F3558C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:*",
              "matchCriteriaId": "623FB30A-0693-4449-80FA-16D36B1BE66C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:*",
              "matchCriteriaId": "9B420167-CD3E-45A7-AD9A-0F83AEC634BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:*",
              "matchCriteriaId": "030A8626-DBBD-4BF2-B362-79B44FB1204D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:*",
              "matchCriteriaId": "D38CFCC3-2AA9-4C8E-9064-FE97E6E8C45C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:*",
              "matchCriteriaId": "65BB78F2-3A1A-4CD1-B8A8-4AB043B5CA50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*",
              "matchCriteriaId": "EDC98AF7-8620-4A25-9BE5-623672599677",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:*",
              "matchCriteriaId": "23E28E0F-9379-4628-B9DC-8C94A45902CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:*",
              "matchCriteriaId": "6631BE51-74FB-40C0-9E91-0EDF2DCADD7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:*",
              "matchCriteriaId": "8B0E4254-14A3-4EB6-9E98-CF45EB08B17F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:*",
              "matchCriteriaId": "0FF63FDE-75F5-44B6-A958-CF653D84D3B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:*",
              "matchCriteriaId": "252B812D-A162-41C1-91CD-08D0CBAC5C46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:*",
              "matchCriteriaId": "421691EA-F55A-4738-8ABD-74B53B6DF155",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:*",
              "matchCriteriaId": "5E7FAB59-142E-4191-9A6F-0744D810CD81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:*",
              "matchCriteriaId": "B010F310-05A1-48AE-B002-8F4C7FA62EB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:*",
              "matchCriteriaId": "4D3B2C32-16D8-415B-A49F-060ECE8F0F33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:*",
              "matchCriteriaId": "43BE83C2-C756-4A5A-A340-B7D1FB52078D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*",
              "matchCriteriaId": "DF340605-8CC8-4543-9F5D-E8602D258CED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:*",
              "matchCriteriaId": "702EBB22-3E9F-4CBE-B855-2E3642C530B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:*",
              "matchCriteriaId": "7C17AD66-684F-4662-AF16-838FF05F47D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:*",
              "matchCriteriaId": "13C25963-CAE7-49AA-A941-254DCE289E35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:*",
              "matchCriteriaId": "B6BF0C2F-DD2B-4864-961F-CA808EF22633",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:*",
              "matchCriteriaId": "8FBB21E9-CB73-4CB1-841A-D1C08167DB51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:*",
              "matchCriteriaId": "4CD55F0B-D854-43D4-A0F5-F83386DB24C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:*",
              "matchCriteriaId": "1097E8DF-3D0E-47C6-882D-E37B22119538",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:*",
              "matchCriteriaId": "8C60F121-1C0B-4EB5-87EF-F1BED070C13B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:*",
              "matchCriteriaId": "04D8514D-CC66-4E6B-90C8-6108F0DAA661",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:*",
              "matchCriteriaId": "4BB65A73-7BB7-42E4-97A3-4D6305172E05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*",
              "matchCriteriaId": "A052DFCA-EDCC-43D7-82C7-E5311F6F7687",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:*",
              "matchCriteriaId": "192A78FB-E141-4F14-8C4A-20A4118B01C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:*",
              "matchCriteriaId": "CA4FEA42-4240-42B1-A5C2-6F74CBBACB92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:*",
              "matchCriteriaId": "7192B894-2616-4852-850B-39CF6FCAC4F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:*",
              "matchCriteriaId": "3323535E-C323-4FD9-81E9-8F7A045EDD59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44:*:*:*:node.js:*:*",
              "matchCriteriaId": "20A0CF2D-C8C0-4972-8F2B-02B67C171CA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*",
              "matchCriteriaId": "12B11714-B961-4330-B241-FC5AF94FDBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:*",
              "matchCriteriaId": "37A7C42B-4986-4BB6-BB27-0324A9AA1CFF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:*",
              "matchCriteriaId": "C793834B-64B4-4DE9-BD7D-79B52C30C34E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:*",
              "matchCriteriaId": "7AD455C8-88BE-4A0A-B33D-3A7811FFB753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:*",
              "matchCriteriaId": "26C475A2-997C-4C3A-8CB6-04AB3534BBC3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server\u0027s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.56 y 9.6.0-alpha.45, el componente LiveQuery de Parse Server no aplica la configuraci\u00f3n requestComplexity.queryDepth al procesar solicitudes de suscripci\u00f3n WebSocket. Un atacante puede enviar una suscripci\u00f3n con operadores l\u00f3gicos profundamente anidados, causando recursi\u00f3n excesiva y consumo de CPU que degrada o interrumpe la disponibilidad del servicio. Este problema ha sido parcheado en las versiones 8.6.56 y 9.6.0-alpha.45."
    }
  ],
  "id": "CVE-2026-33508",
  "lastModified": "2026-06-17T10:37:37.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33508",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-25T13:57:12.645634Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-24T19:16:54.220",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/parse-community/parse-server/pull/10259"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/parse-community/parse-server/pull/10260"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6QH5-M6G3-XHQ6

Vulnerability from github – Published: 2026-03-20 21:48 – Updated: 2026-03-30 13:51

Summary

Parse Server LiveQuery subscription query depth bypass

Details

Impact

Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.

Workarounds

There is no known workaround other than upgrading.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.6.0-alpha.45"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.56"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33508"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T21:48:17Z",
    "nvd_published_at": "2026-03-24T19:16:54Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nParse Server\u0027s LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.\n\nDeployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.\n\n### Patches\n\nThe fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.\n\n### Workarounds\n\nThere is no known workaround other than upgrading.",
  "id": "GHSA-6qh5-m6g3-xhq6",
  "modified": "2026-03-30T13:51:41Z",
  "published": "2026-03-20T21:48:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33508"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/pull/10259"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/pull/10260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/parse-community/parse-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Parse Server LiveQuery subscription query depth bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33508 (GCVE-0-2026-33508)

bit-parse-2026-33508

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-33508

GHSA-6QH5-M6G3-XHQ6

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour