GHSA-v553-g2w6-295p

Source

https://github.com/advisories/GHSA-v553-g2w6-295p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v553-g2w6-295p/GHSA-v553-g2w6-295p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v553-g2w6-295p

Aliases

Published

2026-06-09T09:32:07Z

Modified

2026-08-18T14:55:37Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Details

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-434"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-31T15:49:10Z",
    "nvd_published_at":  "2026-06-09T09:16:29Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.2-0.20260325113131-cfc3e54f30cc

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-v553-g2w6-295p/GHSA-v553-g2w6-295p.json"