CVE-2026-42127CWE-400

Pre-authentication denial of service in the public dashboard query endpoint

High · published June 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-06-22T16:31Z
EPSS history
Timeline
  • 22 JUN 16:31Z
    Pre-authentication denial of service in the public dashboard query endpoint
    cvelistv5