GHSA-9vph-2hvm-x66g
Medium · 6.5CVSS
6.5
EPSS
—
Published
Feb 10, 2026
CISA due date
—
The record
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @cubejs-backend/server-core | 1.1.17 | 1.4.2 |
| npm | @cubejs-backend/server-core | 1.5.0 | 1.5.13 |
Related vulnerabilities
- CVE-2026-25957 Cube is a semantic layer for building data applications. Same vulnerability
- GHSA-v226-32c7-x2v7 Cube Core is vulnerable to privilege escalation via a specially crafted request Also affects @cubejs-backend/server-core
- CVE-2026-25958 Cube is a semantic layer for building data applications. Also affects @cubejs-backend/server-core
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
- CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
- CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755