PT-2026-26791 · Unknown · Parse Server

Mith36 · Publicado 2026-03-20 · Atualizado 2026-03-27 · CVE-2026-33508

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.56 Parse Server versions prior to 9.6.0-alpha.45

Description Parse Server’s LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This affects deployments where the LiveQuery WebSocket endpoint is reachable by untrusted clients.

Recommendations Upgrade to Parse Server version 8.6.56 or later. Upgrade to Parse Server version 9.6.0-alpha.45 or later.

Exploit

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

BIT-PARSE-2026-33508

CVE-2026-33508

GHSA-6QH5-M6G3-XHQ6

Produtos afetados

Parse Server

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33508.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6 · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899 · Correção
• https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b · Correção
• https://github.com/parse-community/parse-server/pull/10260 · Nota
• https://github.com/parse-community/parse-server/pull/10259 · Nota
• https://github.com/parse-community/parse-server · Nota
• https://osv.dev/vulnerability/GHSA-6qh5-m6g3-xhq6 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-33508 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33508 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33508 · Aviso do Fabricante