PT-2026-39751 · Unknown · Audiobookshelf

Bugbunny-Research · CVE-2026-42886 · Published 2026-05-11 · Updated 2026-05-11

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.32.2

Description The server fails to limit the file size of uploads and the decompressed size of entries within ZIP files. An administrator can upload a specially crafted .audiobookshelf ZIP file to the 'POST /api/backups/upload' endpoint. The server uses the zip.entryData() function to decompress the details entry entirely into memory, which can lead to excessive memory consumption and crash the server process due to an out-of-memory condition.

Recommendations Update to version 2.32.2.

Exploit

Fix

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-42886

GHSA-4JQ4-RVQ8-J26H

Affected Products

Audiobookshelf

References · 4

• 🔥 https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42886.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-42886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42886 · Security Note