CVE-2026-25957
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Feb 9, 2026
CISA due date
—
The record
Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @cubejs-backend/server-core | 1.1.17 | 1.4.2 |
| npm | @cubejs-backend/server-core | 1.5.0 | 1.5.13 |
Related vulnerabilities
- GHSA-9vph-2hvm-x66g Cube Core is vulnerable to Denial of Service (DoS) via crafted request Same vulnerability
- GHSA-v226-32c7-x2v7 Cube Core is vulnerable to privilege escalation via a specially crafted request Also affects @cubejs-backend/server-core
- CVE-2026-25958 Cube is a semantic layer for building data applications. Also affects @cubejs-backend/server-core
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
- CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
- CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755