SB2026082532 - Resource exhaustion in snipe-it

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the POST /account/accept/{acceptance} endpoint when rendering an unbounded note field synchronously through the CommonMark mail markdown pipeline. A remote user can submit a specially crafted oversized note to cause a denial of service.

The issue affects default installations using the synchronous queue driver, and exploitation requires an assigned pending checkout acceptance.

Remediation

Install update from vendor's website.

References

• https://github.com/grokability/snipe-it/security/advisories/GHSA-4vcv-fc5x-jjwv
• https://github.com/grokability/snipe-it/commit/66770cfe20cb135e2b7022c7a83d01e6783c914a