GHSA-9vph-2hvm-x66g

Source

https://github.com/advisories/GHSA-9vph-2hvm-x66g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9vph-2hvm-x66g/GHSA-9vph-2hvm-x66g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9vph-2hvm-x66g

Aliases

CVE-2026-25957

Published

2026-02-10T00:29:13Z

Modified

2026-02-22T23:23:49.852772Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Cube Core is vulnerable to Denial of Service (DoS) via crafted request

Details

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

1.5.13 and later (regular release)
1.4.2 (active LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Database specific

{
    "nvd_published_at": "2026-02-09T23:16:06Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-755"
    ],
    "github_reviewed_at": "2026-02-10T00:29:13Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / @cubejs-backend/server-core

Package

Name: @cubejs-backend/server-core; View open source insights on deps.dev
Purl: pkg:npm/%40cubejs-backend/server-core

Affected ranges

Type: SEMVER
Events: Introduced

1.1.17

Fixed

1.4.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9vph-2hvm-x66g/GHSA-9vph-2hvm-x66g.json"

npm / @cubejs-backend/server-core

Package

Name: @cubejs-backend/server-core; View open source insights on deps.dev
Purl: pkg:npm/%40cubejs-backend/server-core

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0

Fixed

1.5.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9vph-2hvm-x66g/GHSA-9vph-2hvm-x66g.json"