CVE-2026-54135

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54135
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54135.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54135
Aliases
  • GHSA-p5hv-3m79-452q
Published
2026-09-11T19:44:39Z
Modified
2026-09-12T14:02:08Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server
Details

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54135.json"
}
References

Affected packages

Git / github.com/simulpiscator/airsane

Affected ranges

Type
GIT
Repo
https://github.com/simulpiscator/airsane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
129cc3bf7258251a0a694dee7741285b59d88f9f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v.*
v.0.4.10
v.0.4.11
v0.*
v0.2
v0.3
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.4
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54135.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265674897289793775019446187221184665697",
                "233918607779145581492692944768262673894",
                "213191847764494748180831161474682017783",
                "9815007674667454165523707138576062164",
                "162379818475369555429072045136777478030",
                "146433469749372147559314954976650891562",
                "332214497799945485557772393208692470227",
                "28063095136307097232483537424790892122",
                "125714491178625791434237557905211423946",
                "221180682440687665329748993003684111404",
                "286084746624496404502862683826196745392",
                "325885209707185484072353379419583972695",
                "268640133102572405310419193565520686709",
                "19112906966990498813340365738415965544",
                "117222338005105734196222423741822280595",
                "204239669405223284401674550878992636203",
                "108587633537507210242609878158511307392",
                "150950438667172773213319345690760912024",
                "108446880719529721117710900572818940020",
                "311459269133239406304144014933351974600",
                "102503836502874057390109985419058127059",
                "332263693657132216501491571564516750915",
                "8737766974799737620139315214225876091",
                "277629142614802691809819742665669284070",
                "106358676404543244574044966830618261062",
                "198207230043211514241234492420376531008",
                "61714683125067747914239426878270635373",
                "33886986284373994127885139232602115415",
                "238755026046084648759589847548469774038"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54135-4865d36f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/simulpiscator/airsane/commit/129cc3bf7258251a0a694dee7741285b59d88f9f",
        "target": {
            "file": "web/httpserver.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "250539573883377687245049571527382126645",
                "288992527031071510878273592242970702608",
                "90295527932911120267618503338946508092",
                "110358179017334828399191121561218459894",
                "301181318982010085058813593292922217542",
                "16648537392638391294691129235556027669",
                "307579716850020702176252386376338345299",
                "83991054824964864177710086502955772903",
                "106917370081345531444627134058277331409",
                "200348370307482133018611201460654209721",
                "311437146941274953767224713115618557184",
                "23060320991929429526711268199683988202",
                "327588271602823792973192116687723846192",
                "58390596816532105382351465358272859292",
                "120062876097442736471669541589442404534"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54135-9cb26740",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/simulpiscator/airsane/commit/129cc3bf7258251a0a694dee7741285b59d88f9f",
        "target": {
            "file": "web/httpserver.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "119839479563341488445169480401587373049",
            "length": 176
        },
        "id": "CVE-2026-54135-cf84aa6e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/simulpiscator/airsane/commit/129cc3bf7258251a0a694dee7741285b59d88f9f",
        "target": {
            "file": "web/httpserver.cpp",
            "function": "HttpServer::Request::contentLength"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "240206800477238053954781513035025874228",
            "length": 640
        },
        "id": "CVE-2026-54135-cfc54793",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/simulpiscator/airsane/commit/129cc3bf7258251a0a694dee7741285b59d88f9f",
        "target": {
            "file": "web/httpserver.cpp",
            "function": "HttpServer::Request::Request"
        }
    }
]
vanir_signatures_modified 
"2026-09-12T14:02:08Z"