CVE-2026-3816

Katalog CVE

CVSS 6.5 · Medium EPSS 0,74%

Kerentanan Improper Resource Shutdown or Release pada owasp defectdojo. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release
CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b3085d676295fdcd41 patch
• https://github.com/DefectDojo/django-DefectDojo/pull/14408 issue tracking · patch
• https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md exploit · advisory pihak ketiga
• https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md#support... exploit · advisory pihak ketiga
• https://vuldb.com/?id.349782 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.769524 advisory pihak ketiga · vdb entry
• https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0 release notes
• https://vuldb.com/?ctiid.349782 permissions required · vdb entry