CVE-2026-47216

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47216

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47216.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47216

Aliases

GHSA-fpx5-8c99-247j

Published

2026-06-12T17:12:55.465Z

Modified

2026-07-22T01:09:35.255231Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint

Details

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerability in the /multi_search endpoint. A specially crafted request can trigger an unhandled exception during request processing, causing the server process to terminate. This issue can be exploited over the network without authentication and results in service unavailability. The duration of impact may vary depending on system configuration and dataset size. This issue has been patched in versions 29.1 and 30.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47216.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-754"
    ]
}

References

Affected packages

Git / github.com/typesense/typesense

Affected ranges

Type

GIT

Repo

https://github.com/typesense/typesense

Events

Introduced

Fixed

f925472d13f78fb21475fec1e146e3511e38ce4b

Introduced

a7f8888daff7c7a2c72866c86b18def1c9f75703

Fixed

d45d46baf3996d1de8bf96a87f375cfb43691560

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "29.1"
        },
        {
            "introduced": "30.0"
        },
        {
            "fixed": "30.2"
        }
    ]
}

Affected versions

0.*

0.7.0

0.7.1

v0.*

v0.23.0

v29.*

v29.0

v30.*

v30.0

v30.1

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "328899680625746939788676975033104509468",
                "117398986347868697308048336097124717357",
                "25087227045178423380684099862761524785",
                "277036075908491128455468522905145292794",
                "9793382730154521733500284659875201635",
                "119435676763694894915194632829293954468",
                "71512321218375804823344966978782254450"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/typesense/typesense/commit/f925472d13f78fb21475fec1e146e3511e38ce4b",
        "signature_type": "Line",
        "target": {
            "file": "test/core_api_utils_test.cpp"
        },
        "id": "CVE-2026-47216-505e5fd8",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1413.0,
            "function_hash": "267431184613837974825057544897042900966"
        },
        "signature_version": "v1",
        "source": "https://github.com/typesense/typesense/commit/d45d46baf3996d1de8bf96a87f375cfb43691560",
        "signature_type": "Function",
        "target": {
            "function": "Index::get_field_token_its",
            "file": "src/index.cpp"
        },
        "id": "CVE-2026-47216-828b260e",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "127232973632035196340384144748419221196",
                "222827363562427925541456640410728047645",
                "3813103139700351087536066579674744340",
                "279554267041194031301291167361066734934"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/typesense/typesense/commit/d45d46baf3996d1de8bf96a87f375cfb43691560",
        "signature_type": "Line",
        "target": {
            "file": "src/index.cpp"
        },
        "id": "CVE-2026-47216-bd44f23a",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-22T01:09:35Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47216.json"