CVE-2026-56324

Katalog CVE

CVSS 8.2 · High EPSS 0,46%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 8.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27
• https://www.vulncheck.com/advisories/capgo-rate-limit-bypass-via-user-controlled-device-id-parameter