CVE-2026-64861
- Source
- https://cve.org/CVERecord?id=CVE-2026-64861
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64861.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64861
- Aliases
-
- GHSA-prh2-g8pv-m7p9
- Published
- 2026-11-11T18:06:59Z
- Modified
- 2026-11-12T02:48:37Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)
- Details
-
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64861.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64861.json
- https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7
- https://github.com/getprobo/probo/pull/1424
- https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0
- https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9
- https://nvd.nist.gov/vuln/detail/CVE-2026-64861
Affected packages
Git / github.com/getprobo/probo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/getprobo/probo
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.222.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "bf255b198cb6c9f44cd183c49743c9ffdaa44ce7" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
@probo/cookie-banner/v0.*
@probo/cookie-banner/v0.10.0
@probo/cookie-banner/v0.3.0
@probo/cookie-banner/v0.3.1
@probo/cookie-banner/v0.4.0
@probo/cookie-banner/v0.4.1
@probo/cookie-banner/v0.5.0
@probo/cookie-banner/v0.6.0
@probo/cookie-banner/v0.7.0
@probo/cookie-banner/v0.8.0
@probo/cookie-banner/v0.9.0
@probo/cookie-banner/v0.9.1
@probo/cookie-banner/v0.9.2
@probo/cookie-banner/v0.9.3
@probo/n8n-nodes-probo/v0.*
@probo/n8n-nodes-probo/v0.182.0
@probo/n8n-nodes-probo/v0.183.0
@probo/n8n-nodes-probo/v0.184.0
@probo/n8n-nodes-probo/v0.185.0
@probo/n8n-nodes-probo/v0.186.0
@probo/n8n-nodes-probo/v0.187.0
@probo/n8n-nodes-probo/v0.187.1
@probo/n8n-nodes-probo/v0.188.0
@probo/n8n-nodes-probo/v0.189.0
@probo/n8n-nodes-probo/v0.190.0
@probo/n8n-nodes-probo/v0.191.0
@probo/n8n-nodes-probo/v0.192.0
@probo/n8n-nodes-probo/v0.193.0
@probo/n8n-nodes-probo/v0.194.0
@probo/n8n-nodes-probo/v0.195.0
@probo/n8n-nodes-probo/v0.196.0
@probo/n8n-nodes-probo/v0.197.0
@probo/n8n-nodes-probo/v0.198.0
helm/v0.*
helm/v0.1.0
helm/v0.2.0
helm/v0.2.1
helm/v0.3.0
helm/v0.4.0
helm/v0.5.0
helm/v0.6.0
helm/v0.7.0
helm/v0.8.0
helm/v0.9.0
helm/v0.9.1
prb/v0.*
prb/v0.182.0
prb/v0.183.0
prb/v0.183.1
prb/v0.184.0
prb/v0.185.0
prb/v0.186.0
prb/v0.187.0
prb/v0.188.0
prb/v0.189.0
prb/v0.190.0
prb/v0.191.0
prb/v0.192.0
prb/v0.193.0
prb/v0.194.0
prb/v0.195.0
prb/v0.196.0
prb/v0.197.0
prb/v0.197.1
probo-agent/v0.*
probo-agent/v0.1.0
probo-agent/v0.1.1
proboctl/v0.*
proboctl/v0.1.0
proboctl/v0.2.0
proboctl/v0.3.0
proboctl/v0.3.1
proboctl/v0.4.0
proboctl/v0.5.0
proboctl/v0.6.0
proboctl/v0.7.0
proboctl/v0.7.1
proboctl/v0.8.0
probod-bootstrap/v0.*
probod-bootstrap/v0.1.1
probod-bootstrap/v0.1.2
probod-bootstrap/v0.2.0
probod-bootstrap/v0.3.0
probod/v0.*
probod/v0.182.0
probod/v0.183.0
probod/v0.184.0
probod/v0.184.1
probod/v0.184.2
probod/v0.185.0
probod/v0.186.0
probod/v0.186.1
probod/v0.187.0
probod/v0.188.0
probod/v0.189.0
probod/v0.190.0
probod/v0.190.1
probod/v0.191.0
probod/v0.192.0
probod/v0.193.0
probod/v0.193.1
probod/v0.194.0
probod/v0.195.0
probod/v0.196.0
probod/v0.196.1
probod/v0.197.0
probod/v0.198.0
probod/v0.199.0
probod/v0.199.1
probod/v0.200.0
probod/v0.200.1
probod/v0.201.0
probod/v0.202.0
probod/v0.202.1
probod/v0.202.2
probod/v0.203.0
probod/v0.204.0
probod/v0.205.0
probod/v0.206.0
probod/v0.207.0
probod/v0.208.0
probod/v0.208.1
probod/v0.209.0
probod/v0.210.0
probod/v0.211.0
probod/v0.211.1
probod/v0.211.2
probod/v0.212.0
probod/v0.213.0
probod/v0.214.0
probod/v0.215.0
probod/v0.215.1
probod/v0.216.0
probod/v0.216.1
probod/v0.217.0
probod/v0.218.0
probod/v0.218.1
probod/v0.219.0
probod/v0.220.0
probod/v0.221.0
v0.*
v0.1.0
v0.10.0
v0.10.1
v0.100.0
v0.101.0
v0.101.1
v0.102.0
v0.103.0
v0.104.0
v0.105.0
v0.106.0
v0.107.0
v0.107.1
v0.108.0
v0.109.0
v0.11.0
v0.11.1
v0.110.0
v0.110.1
v0.110.2
v0.111.0
v0.111.1
v0.111.2
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.112.4
v0.113.0
v0.114.0
v0.115.0
v0.116.0
v0.116.1
v0.116.10
v0.116.11
v0.116.12
v0.116.13
v0.116.14
v0.116.15
v0.116.2
v0.116.3
v0.116.4
v0.116.5
v0.116.6
v0.116.7
v0.116.8
v0.116.9
v0.117.0
v0.117.1
v0.117.2
v0.117.3
v0.118.0
v0.118.1
v0.118.2
v0.119.0
v0.119.1
v0.12.0
v0.120.0
v0.121.0
v0.121.1
v0.122.0
v0.123.0
v0.123.1
v0.123.2
v0.123.3
v0.124.0
v0.124.1
v0.124.2
v0.125.0
v0.125.1
v0.125.1-1
v0.125.1-2
v0.125.1-3
v0.125.1-4
v0.126.0
v0.126.1
v0.127.0
v0.127.1
v0.128.0
v0.129.0
v0.129.1
v0.129.2
v0.129.3
v0.13.0
v0.13.1
v0.13.2
v0.130.0
v0.130.1
v0.130.2
v0.130.3
v0.131.0
v0.131.1
v0.131.2
v0.132.0
v0.133.0
v0.134.0
v0.134.1
v0.134.2
v0.134.3
v0.135.0
v0.135.1
v0.136.0
v0.137.0
v0.137.1
v0.137.2
v0.137.3
v0.138.0
v0.138.1
v0.138.2
v0.139.0
v0.14.0
v0.140.0
v0.141.0
v0.142.0
v0.142.1
v0.142.2
v0.143.0
v0.144.0
v0.145.0
v0.146.0
v0.146.1
v0.147.0
v0.148.0
v0.149.0
v0.149.1
v0.15.0
v0.15.1
v0.150.0
v0.151.0
v0.152.0
v0.153.0
v0.153.1
v0.153.2
v0.154.0
v0.154.1
v0.154.2
v0.155.0
v0.156.0
v0.156.1
v0.157.0
v0.158.0
v0.159.0
v0.16.0
v0.160.0
v0.160.1
v0.160.2
v0.161.0
v0.161.1
v0.161.2
v0.162.0
v0.162.1
v0.163.0
v0.163.1
v0.163.2
v0.164.0
v0.165.0
v0.165.1
v0.165.2
v0.165.3
v0.166.0
v0.167.0
v0.168.0
v0.168.1
v0.168.2
v0.169.0
v0.169.1
v0.17.0
v0.170.0
v0.171.0
v0.171.1
v0.172.0
v0.172.1
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.176.1
v0.177.0
v0.177.1
v0.178.0
v0.179.0
v0.179.1
v0.18.0
v0.18.1
v0.180.0
v0.181.0
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.20.0
v0.20.1
v0.204.0
v0.21.0
v0.216.1
v0.22.0
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.30.0
v0.30.1
v0.31.0
v0.32.0
v0.33.0
v0.33.1
v0.33.2
v0.33.3
v0.33.4
v0.33.5
v0.33.6
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.37.1
v0.37.2
v0.37.3
v0.37.4
v0.37.5
v0.38.0
v0.38.1
v0.39.0
v0.4.0
v0.4.1
v0.4.2
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.43.1
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.46.1
v0.46.2
v0.47.0
v0.48.0
v0.48.1
v0.49.0
v0.5.0
v0.50.0
v0.50.1
v0.51.0
v0.51.1
v0.52.0
v0.53.0
v0.54.0
v0.55.0
v0.56.0
v0.57.0
v0.57.1
v0.58.0
v0.58.1
v0.58.2
v0.58.3
v0.58.4
v0.59.0
v0.59.1
v0.6.0
v0.60.0
v0.61.0
v0.61.1
v0.62.0
v0.63.0
v0.63.1
v0.64.0
v0.64.1
v0.65.0
v0.65.1
v0.66.0
v0.66.1
v0.67.0
v0.67.1
v0.67.2
v0.68.0
v0.68.1
v0.68.2
v0.68.3
v0.69.0
v0.7.0
v0.70.0
v0.71.0
v0.72.0
v0.73.0
v0.73.1
v0.74.0
v0.74.1
v0.74.2
v0.74.3
v0.74.4
v0.74.5
v0.74.6
v0.74.7
v0.75.0
v0.75.1
v0.76.0
v0.77.0
v0.78.0
v0.79.0
v0.8.0
v0.80.0
v0.80.1
v0.80.2
v0.81.0
v0.82.0
v0.83.0
v0.84.0
v0.85.0
v0.86.0
v0.86.1
v0.86.2
v0.86.3
v0.86.4
v0.87.0
v0.88.0
v0.88.1
v0.88.2
v0.88.3
v0.88.5
v0.88.6
v0.88.7
v0.88.8
v0.89.0
v0.89.1
v0.9.0
v0.90.0
v0.90.1
v0.91.0
v0.92.0
v0.93.0
v0.94.0
v0.94.1
v0.94.2
v0.95.0
v0.96.0
v0.96.1
v0.97.0
v0.98.0
v0.98.1
v0.99.0