PYSEC-2026-3469

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/infinistore/PYSEC-2026-3469.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3469
Aliases
Published
2026-07-23T11:41:39.091225Z
Modified
2026-07-23T15:00:13.753008193Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
Details

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References

Affected packages

PyPI / infinistore

Package

Name
infinistore
View open source insights on deps.dev
Purl
pkg:pypi/infinistore

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.2.33

Affected versions

0.*
0.1.72
0.1.73
0.1.74
0.1.82
0.1.89
0.1.90
0.1.91
0.1.96
0.1.98
0.1.99
0.1.100
0.1.101
0.1.115
0.1.128
0.1.129
0.1.136
0.1.137
0.1.152
0.2.7
0.2.8
0.2.11
0.2.22
0.2.32
0.2.33

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/infinistore/PYSEC-2026-3469.yaml"