{"id":"CVE-2026-25957","aliases":["EUVD-2026-6246","GHSA-9vph-2hvm-x66g"],"status":"published","title":"Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request","description":"Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00434,"percentile":0.38015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2026-02-09T22:39:16Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"npm","package":"@cubejs-backend/server-core","fixed_in":["1.4.2","1.5.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@cubejs-backend/server-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.17"},{"fixed":"1.4.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@cubejs-backend/server-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.13"}]}]},{"source":"osv","ecosystem":"npm","package":"@cubejs-backend/server-core","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.17"},{"fixed":"1.4.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@cubejs-backend/server-core","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.13"}]}]}],"products":[{"vendor":"cube","product":"cube.js"},{"vendor":"cube-js","product":"cube"}],"references":[{"url":"https://github.com/cube-js/cube/security/advisories/GHSA-9vph-2hvm-x66g","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25957","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vph-2hvm-x66g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25957.json","tags":["advisory"]},{"url":"https://github.com/cube-js/cube","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25957","title":"Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request","description":"Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.","status":"published","published":"2026-02-09T22:39:16.121Z","modified":"2026-02-11T21:23:47.95Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-6246","description":"Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.","status":"published","published":"2026-02-09T22:39:16Z","modified":"2026-02-11T21:23:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:40.797648Z"}],"ghsa":[{"id":"GHSA-9vph-2hvm-x66g","title":"Cube Core is vulnerable to Denial of Service (DoS) via crafted request","description":"### **Impact**\n\nIt is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.\n\n### Affected Versions:\n\n`\u003e= 1.1.17`\n\n### Mitigation:\n\nUpgrade to a patched version:\n\n- 1.5.13 and later (regular release)\n- 1.4.2 (active [LTS release](https://cube.dev/docs/product/administration/distribution#long-term-support))\n\n### **References**\n\nThe issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.","status":"published","published":"2026-02-10T00:29:13Z","modified":"2026-02-10T02:57:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-25957","description":"Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.","status":"published","published":"2026-02-09T23:16:06.78Z","modified":"2026-06-17T10:25:29.407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25957","title":"Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request","description":"Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.","status":"published","published":"2026-02-09T22:39:16.121Z","modified":"2026-10-28T02:30:32.583475635Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-9vph-2hvm-x66g","title":"Cube Core is vulnerable to Denial of Service (DoS) via crafted request","description":"### **Impact**\n\nIt is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.\n\n### Affected Versions:\n\n`\u003e= 1.1.17`\n\n### Mitigation:\n\nUpgrade to a patched version:\n\n- 1.5.13 and later (regular release)\n- 1.4.2 (active [LTS release](https://cube.dev/docs/product/administration/distribution#long-term-support))\n\n### **References**\n\nThe issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.","status":"published","published":"2026-02-10T00:29:13Z","modified":"2026-02-22T23:23:49.852772Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}