CVE-2026-86734CWE-400denial-of-service

CVE-2026-86734

Medium · published September 8, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-08T20:18Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.18.7.1
References (3)
https://github.com/grokability/snipe-it/commit/66770cfe20cb135e2b7022c7a83d01e6783c914a · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-4vcv-fc5x-jjwv · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.1-denial-of-service-via-unbounded-note-field · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:14Z
    Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
    cvelistv5