CVE-2026-42886

{
  "id": "CVE-2026-42886",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T20:25:45.020",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP file entirely into memory using zip.entryData(), with no limit on the decompressed size. The upload middleware also has no file size limit. An admin user can upload a crafted ZIP containing a highly compressed details entry that, when decompressed, consumes hundreds of megabytes or gigabytes of memory, crashing the server process via out-of-memory. This vulnerability is fixed in 2.32.2."
    },
    {
      "lang": "es",
      "value": "Audiobookshelf es un servidor de audiolibros y podcasts autoalojado. Antes de la versión 2.32.2, el endpoint POST /API/backups/upload descomprime la entrada details de un archivo ZIP .audiobookshelf subido completamente en memoria usando zip.entryData(), sin límite en el tamaño descomprimido. El middleware de subida tampoco tiene límite de tamaño de archivo. Un usuario administrador puede subir un ZIP manipulado que contiene una entrada details altamente comprimida que, al descomprimirse, consume cientos de megabytes o gigabytes de memoria, provocando la caída del proceso del servidor por falta de memoria. Esta vulnerabilidad está corregida en la versión 2.32.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "advplyr",
          "product": "audiobookshelf",
          "versions": [
            {
              "version": "< 2.33.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T12:57:47.046136Z",
          "id": "CVE-2026-42886",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-409"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}