CVE-2026-109954

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109954
Aliases
  • GHSA-jhh9-hrgh-c9gv
Published
2026-10-13T13:27:19Z
Modified
2026-10-14T02:46:47Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
Details

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-362"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109954.json"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
1d0949cf88a80f391ff0ea74dd8ba894218284af
Introduced
9b34b0263bd4425fe3beedd0c687c08575eda190
Fixed
2005ac9219b66128d7f6789736be50a05de6dc7d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "9.0.0"
        },
        {
            "fixed":  "9.10.2-alpha.5"
        },
        {
            "introduced":  "5.4.0"
        },
        {
            "fixed":  "8.6.96"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

5.*
5.4.0
6.*
6.0.0
6.1.0
6.2.0
6.2.1
6.2.2
6.3.0
6.3.1
6.4.0
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
8.*
8.0.0
8.0.1
8.0.2
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.10
8.6.11
8.6.12
8.6.13
8.6.14
8.6.15
8.6.16
8.6.17
8.6.18
8.6.19
8.6.2
8.6.20
8.6.21
8.6.22
8.6.23
8.6.24
8.6.25
8.6.26
8.6.27
8.6.28
8.6.29
8.6.3
8.6.30
8.6.31
8.6.32
8.6.33
8.6.34
8.6.35
8.6.36
8.6.37
8.6.38
8.6.39
8.6.4
8.6.40
8.6.41
8.6.42
8.6.43
8.6.44
8.6.45
8.6.46
8.6.47
8.6.48
8.6.49
8.6.5
8.6.50
8.6.51
8.6.52
8.6.53
8.6.54
8.6.55
8.6.56
8.6.57
8.6.58
8.6.59
8.6.6
8.6.60
8.6.61
8.6.62
8.6.63
8.6.64
8.6.65
8.6.66
8.6.67
8.6.68
8.6.69
8.6.7
8.6.70
8.6.71
8.6.72
8.6.73
8.6.74
8.6.75
8.6.76
8.6.77
8.6.78
8.6.79
8.6.8
8.6.80
8.6.81
8.6.82
8.6.83
8.6.84
8.6.85
8.6.86
8.6.87
8.6.88
8.6.89
8.6.9
8.6.90
8.6.91
8.6.92
8.6.93
8.6.94
8.6.95
9.*
9.0.0
9.1.0
9.1.1
9.10.0
9.10.1
9.10.2-alpha.1
9.10.2-alpha.2
9.10.2-alpha.3
9.10.2-alpha.4
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0
9.5.1
9.6.0
9.6.1
9.7.0
9.8.0
9.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109954.json"