FKIE_CVE-2026-63462

Vulnerability from fkie_nvd - Published: 2026-08-21 19:17 - Updated: 2026-10-14 19:10
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
References
security-advisories@github.comhttps://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf
security-advisories@github.comhttps://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1
security-advisories@github.comhttps://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d
security-advisories@github.comhttps://github.com/Unleash/unleash/releases/tag/v7.5.2
security-advisories@github.comhttps://github.com/Unleash/unleash/releases/tag/v7.6.5
security-advisories@github.comhttps://github.com/Unleash/unleash/releases/tag/v8.0.2
security-advisories@github.comhttps://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "unleash",
          "vendor": "Unleash",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.5.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.6.0, \u003c 7.6.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."
    },
    {
      "lang": "es",
      "value": "Unleash es una plataforma de gesti\u00f3n de caracter\u00edsticas de c\u00f3digo abierto. Antes de las versiones 7.5.2, 7.6.5 y 8.0.2, la ruta de error de validaci\u00f3n de OpenAPI compartida en src/lib/error/bad-data-error.ts pasa un valor de solicitud sin procesar de lodash.get a JSON.stringify en genericErrorMessage y fromOpenApiValidationErrors sin proteger contra el agotamiento de la pila. Un atacante no autenticado puede enviar un valor JSON de aproximadamente 10 KB anidado miles de niveles de profundidad a POST /edge/validate, POST /edge/issue-token, o a otro endpoint validado por OpenAPI, causando RangeError: Maximum call stack size exceeded en openAPIValidationMiddleware y terminando el proceso de Node porque ning\u00fan gestor de uncaughtException lo recupera. Reenviar la solicitud puede mantener una interrupci\u00f3n completa del servicio. Este problema est\u00e1 solucionado en las versiones 7.5.2, 7.6.5 y 8.0.2."
    }
  ],
  "id": "CVE-2026-63462",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63462",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T17:32:06.100866Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T19:17:31.927",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.