CVE-2026-86734

    Dashboard / Vulnerabilities / CVE-2026-86734

    CVE-2026-86734

    Published: 8 Sept 2026Last Modified: 12 Sept 2026

    Summary: Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

    Details: Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86734.json, https://github.com/grokability/snipe-it/security/advisories/GHSA-4vcv-fc5x-jjwv, https://nvd.nist.gov/vuln/detail/CVE-2026-86734, https://www.vulncheck.com/advisories/snipe-it-before-8.7.1-denial-of-service-via-unbounded-note-field, https://github.com/grokability/snipe-it/commit/66770cfe20cb135e2b7022c7a83d01e6783c914a

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d1e89f748be051d72526e2316d76b382e91aef39

    Affected versions

    v8.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86734 | CVE-DB