CVE-2026-94018

HighCVSS 8.8

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.

Risk Assessment

An unauthenticated attacker can crash the server or potentially exploit the uninitialized pointer for further attacks. This poses a threat to service availability.

Recommendation

Apply the vendor fix for the Web add-on. Until then, consider restricting access to the add-on's HTTP server or deploying filtering rules for malformed PUT requests.

Other vulnerabilities in Web add-on

CVE-2026-93003Medium
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is reported to the server as though it were a header, letting a client control request framing decisions it should not reach.

Original NVD description (English source)

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS