CVE-2026-44596

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44596
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44596.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44596
Aliases
Published
2026-07-16T16:04:11.794Z
Modified
2026-08-07T17:31:48.040298Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Yamcs: No Rate Limiting on Authentication Endpoint
Details

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44596.json",
    "cwe_ids": [
        "CWE-307"
    ]
}
References

Affected packages

Git / github.com/yamcs/yamcs

Affected ranges

Type
GIT
Repo
https://github.com/yamcs/yamcs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1262da4e2ffe7538d9ae4d6e7b22a345b3e1a2bb
Fixed
309218c651680f79df11a8d0f8628f7033f98a83
Fixed
64392df531fbcbc65f19ee5724c4c23d289f49fc
Fixed
8bf5af6fe227bbf8ead15e60644b7ddbf345d623
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.12.7"
        }
    ],
    "cpe": "cpe:2.3:a:spaceapplications:yamcs:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
before-removing-cfdp-half-implemented-features
v0.*
v0.26.0
v0.26.1
v0.28.0
v0.28.0-20150811
v0.28.0-20150817
v0.28.0-20150820
v0.28.0-20150824
v0.28.0-20150825
v0.28.0-20150826
v0.28.0-20150827
v0.28.0-20150828
v0.28.0-20150901
v0.28.0-20150902
v0.28.0-20150902-2
v0.28.0-20150903
v0.29.0
v0.29.1
v0.29.1-20151214
v0.29.1-20160119
v0.29.1-20160127
v0.29.3
v0.29.3-20160608
v0.29.4
yamcs-0.*
yamcs-0.30.0
yamcs-3.*
yamcs-3.0.0
yamcs-3.1.0
yamcs-3.1.1
yamcs-3.1.2
yamcs-3.2.0
yamcs-3.2.1
yamcs-3.2.2
yamcs-3.3.0
yamcs-3.4.0
yamcs-4.*
yamcs-4.0.1
yamcs-4.1.1
yamcs-4.1.2
yamcs-4.10.0
yamcs-4.10.1
yamcs-4.10.2
yamcs-4.10.3
yamcs-4.10.4
yamcs-4.10.5
yamcs-4.10.6
yamcs-4.10.7
yamcs-4.10.8
yamcs-4.10.9
yamcs-4.2.0
yamcs-4.2.1
yamcs-4.2.2
yamcs-4.3.0
yamcs-4.3.1
yamcs-4.4.0
yamcs-4.4.1
yamcs-4.4.2
yamcs-4.7
yamcs-4.7.1
yamcs-4.7.2
yamcs-4.7.3
yamcs-4.8.0
yamcs-4.8.1
yamcs-4.9.0
yamcs-4.9.1
yamcs-4.9.2
yamcs-4.9.3
yamcs-4.9.4
yamcs-4.9.5
yamcs-5.*
yamcs-5.0.0
yamcs-5.0.1
yamcs-5.1.0
yamcs-5.1.1
yamcs-5.1.2
yamcs-5.1.3
yamcs-5.10.0
yamcs-5.10.1
yamcs-5.10.2
yamcs-5.10.3
yamcs-5.10.4
yamcs-5.10.5
yamcs-5.10.6
yamcs-5.10.7
yamcs-5.10.8
yamcs-5.10.9
yamcs-5.11.0
yamcs-5.11.1
yamcs-5.11.2
yamcs-5.11.3
yamcs-5.11.4
yamcs-5.11.5
yamcs-5.11.6
yamcs-5.11.7
yamcs-5.12.0
yamcs-5.12.1
yamcs-5.12.2
yamcs-5.12.3
yamcs-5.12.4
yamcs-5.12.5
yamcs-5.12.6
yamcs-5.2.0
yamcs-5.3.0
yamcs-5.3.1
yamcs-5.3.2
yamcs-5.3.3
yamcs-5.3.4
yamcs-5.3.5
yamcs-5.4.0
yamcs-5.4.1
yamcs-5.4.2
yamcs-5.4.3
yamcs-5.5.0
yamcs-5.5.1
yamcs-5.5.2
yamcs-5.5.3
yamcs-5.5.4
yamcs-5.5.5
yamcs-5.5.6
yamcs-5.5.7
yamcs-5.6.0
yamcs-5.6.1
yamcs-5.6.2
yamcs-5.7.0
yamcs-5.7.1
yamcs-5.7.10
yamcs-5.7.2
yamcs-5.7.3
yamcs-5.7.4
yamcs-5.7.5
yamcs-5.7.6
yamcs-5.7.7
yamcs-5.7.8
yamcs-5.7.9
yamcs-5.8.0
yamcs-5.8.1
yamcs-5.8.2
yamcs-5.8.3
yamcs-5.8.4
yamcs-5.8.5
yamcs-5.8.6
yamcs-5.8.7
yamcs-5.8.8
yamcs-5.9.0
yamcs-5.9.1
yamcs-5.9.2
yamcs-5.9.3
yamcs-5.9.4
yamcs-5.9.5
yamcs-5.9.6
yamcs-5.9.7
yamcs-5.9.8

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 812.0,
            "function_hash": "322859923667186652066320800378209192252"
        },
        "id": "CVE-2026-44596-0953c310",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "function": "handle",
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293434320184229543889951541269216084001",
                "239053612775522236356360026895988789878",
                "183807888978286266906257681992988153242",
                "1724301722128073950614073494936980543"
            ]
        },
        "id": "CVE-2026-44596-0b3a13e9",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "141841151487326013552027647373389697976",
                "23426485942633164657609989627436161567",
                "340208651299121167096265212630745840303",
                "69783285633784489637694235189033361093",
                "75369258655284321477260438254040890114",
                "265363224564555485725441745010933421797",
                "102377224442769571368170511737913196399",
                "131916818209114535190390801576138355859",
                "289865028343641542806238029835624583711",
                "15995268096269837971845571565996147590",
                "141746774854103479229389631227195786901",
                "169478198255512452627184314288525135200",
                "277803219656068486614665727804529170846",
                "134667758888613228807949838616892332236",
                "307556971421223761094162430950065102526"
            ]
        },
        "id": "CVE-2026-44596-183261bc",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 248.0,
            "function_hash": "130459726947578183299408144486978622660"
        },
        "id": "CVE-2026-44596-19a562c6",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "function": "getOriginalHostAddress",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2604.0,
            "function_hash": "212826502150893379923269183992207746382"
        },
        "id": "CVE-2026-44596-1a045610",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "function": "getSpec",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 64.0,
            "function_hash": "10716308527956773721278740954375060894"
        },
        "id": "CVE-2026-44596-2e8e63f7",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "function": "AuthHandler",
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 3440.0,
            "function_hash": "16362187681297619709374040597766403556"
        },
        "id": "CVE-2026-44596-398e18d6",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "function": "init",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 3440.0,
            "function_hash": "16362187681297619709374040597766403556"
        },
        "id": "CVE-2026-44596-3995861c",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "function": "init",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 64.0,
            "function_hash": "10716308527956773721278740954375060894"
        },
        "id": "CVE-2026-44596-42a9f2bf",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "function": "AuthHandler",
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 248.0,
            "function_hash": "130459726947578183299408144486978622660"
        },
        "id": "CVE-2026-44596-7301edf2",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "function": "getOriginalHostAddress",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2604.0,
            "function_hash": "212826502150893379923269183992207746382"
        },
        "id": "CVE-2026-44596-a0d9779a",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "function": "getSpec",
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 812.0,
            "function_hash": "322859923667186652066320800378209192252"
        },
        "id": "CVE-2026-44596-abdbede2",
        "signature_type": "Function",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "function": "handle",
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "141841151487326013552027647373389697976",
                "23426485942633164657609989627436161567",
                "340208651299121167096265212630745840303",
                "69783285633784489637694235189033361093",
                "75369258655284321477260438254040890114",
                "265363224564555485725441745010933421797",
                "102377224442769571368170511737913196399",
                "131916818209114535190390801576138355859",
                "289865028343641542806238029835624583711",
                "15995268096269837971845571565996147590",
                "141746774854103479229389631227195786901",
                "169478198255512452627184314288525135200",
                "277803219656068486614665727804529170846",
                "134667758888613228807949838616892332236",
                "307556971421223761094162430950065102526"
            ]
        },
        "id": "CVE-2026-44596-ae2e8b81",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/HttpServer.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "98354799184966063135850157282789766582",
                "10154196798899912988104554770946720980",
                "323697764414073246946445267858528619405",
                "64427507559693119751568191649667625026",
                "251469252127173842699277878760318402150",
                "37964300484466295897385519337300970058",
                "296497971199781262346648504730381468644",
                "23147520311656588697671320612572748625",
                "197844119563564311095407281460336962878",
                "49995633588435691351300386539620098195",
                "143494811802193089473962207036072580695",
                "112128666403424859369420810409773809583",
                "232430680275018865906057437496961014067",
                "308991352603857844859125884714952030680",
                "171750950248935524056361430445215073149",
                "138873451193833509867269249708997002880",
                "138409844406294909717744117026952290393",
                "150365753970654947996732084130727503436",
                "214358724624658065910713676231531219775",
                "188843054382795578217738990761884306235",
                "136193571170618446268229526410202334086",
                "195231666763906059733507519724715040110",
                "285273924749616401984254510349767856466",
                "117937074817142191132759686003806711953",
                "76417416418409466609468722506785918253"
            ]
        },
        "id": "CVE-2026-44596-b41d2cfb",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "98354799184966063135850157282789766582",
                "10154196798899912988104554770946720980",
                "323697764414073246946445267858528619405",
                "64427507559693119751568191649667625026",
                "251469252127173842699277878760318402150",
                "37964300484466295897385519337300970058",
                "296497971199781262346648504730381468644",
                "23147520311656588697671320612572748625",
                "197844119563564311095407281460336962878",
                "49995633588435691351300386539620098195",
                "143494811802193089473962207036072580695",
                "112128666403424859369420810409773809583",
                "232430680275018865906057437496961014067",
                "308991352603857844859125884714952030680",
                "171750950248935524056361430445215073149",
                "138873451193833509867269249708997002880",
                "138409844406294909717744117026952290393",
                "150365753970654947996732084130727503436",
                "214358724624658065910713676231531219775",
                "188843054382795578217738990761884306235",
                "136193571170618446268229526410202334086",
                "195231666763906059733507519724715040110",
                "285273924749616401984254510349767856466",
                "117937074817142191132759686003806711953",
                "76417416418409466609468722506785918253"
            ]
        },
        "id": "CVE-2026-44596-b4ea1f6a",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293434320184229543889951541269216084001",
                "239053612775522236356360026895988789878",
                "183807888978286266906257681992988153242",
                "1724301722128073950614073494936980543"
            ]
        },
        "id": "CVE-2026-44596-e58a6f5f",
        "signature_type": "Line",
        "source": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
        "target": {
            "file": "yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T17:31:48Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44596.json"