SB2026090828 - Multiple vulnerabilities in Crow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090828

SB2026090828 - Multiple vulnerabilities in Crow

Published: September 8, 2026

Security Bulletin ID SB2026090828
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access protected WebSocket functionality.

The vulnerability exists due to improper authentication in the WebSocket upgrade branch of the connection request handler when processing a WebSocket upgrade request rejected by global authentication middleware. A remote attacker can send an unauthenticated WebSocket upgrade request to bypass authentication and access protected WebSocket functionality.


2) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the crow::json::load() JSON parser when processing deeply nested JSON request bodies. A remote attacker can send a specially crafted request containing deeply nested JSON objects to cause a denial of service.

The issue can terminate the entire server process on Windows when the recursion exhausts available stack space.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in WebSocket fragmented-message handling when processing fragmented WebSocket messages. A remote attacker can send an oversized message as individually permitted fragments to cause a denial of service.

The issue affects applications that use max_payload() or websocket_max_payload() as a resource-control boundary.


4) Open redirect (CVE-ID: N/A)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect victims to an attacker-controlled site.

The vulnerability exists due to improper validation of redirect targets in the automatic trailing-slash redirect handling in include/crow/routing.h when processing a request URL beginning with two slashes. A remote attacker can send a victim a crafted URL to redirect the victim to an attacker-controlled origin.

Exploitation requires a matching root-level trailing-slash dynamic path route and user interaction. Reverse proxies that reject or normalize double slashes may prevent the request from reaching Crow.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access and modify JSON files outside the configured session directory.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in the FileStore session middleware when processing a client-supplied session cookie. A remote attacker can submit a traversal session cookie to access and modify session-compatible JSON files outside the configured session directory.

Exploitation requires FileStore to be selected and a targeted existing .json file to be accessible to the Crow process and accepted as JSON.


Remediation

Install update from vendor's website.

References