CVE-2026-19974

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19974

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19974.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19974

Published

2026-08-17T02:15:08Z

Modified

2026-08-22T03:31:03Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication

Details

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19974.json"
}

References

Affected packages

Git / github.com/treefrogframework/treefrog-framework

Affected ranges

Type

GIT

Repo

https://github.com/treefrogframework/treefrog-framework

Events

Introduced

e305db96f240aafc8323fcbe4e3c286ab3339299

Last Affected

383c265e232fa21e4bc71bfd8ff8567c3e7c3ba1

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.11.0"
        },
        {
            "last_affected": "2.11.0"
        },
        {
            "introduced": "2.11.1"
        },
        {
            "last_affected": "2.11.1"
        },
        {
            "introduced": "2.11.2"
        },
        {
            "last_affected": "2.11.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*

2.11.0

2.11.1

2.11.2

v2.*

v2.11.0

v2.11.1

v2.11.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19974.json"