EUVD-2026-83265Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Parseable HTTP endpoint
-
DeliverySend request with malformed x-amz-firehose-common-attributes header
-
ExploitPre-auth middleware unwrap() panics
-
ExecutionRequest handling aborts
-
ImpactRepeat to force restart loops and deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | No authentication or user interaction is required: the vulnerable unwrap() chain in src/handlers/http/middleware.rs runs BEFORE authentication whenever a request carries the x-amz-firehose-common-attributes header (the AWS Kinesis Firehose common-attributes ingestion header). The specific trigger is any of: header bytes that are not valid UTF-8 (to_str() fails), a header value that is not valid JSON deserializable into the Message struct (serde_json::from_str fails), or a derived authorization/x-p-stream value that is not a valid HTTP header (HeaderValue::from_str fails). It affects Parseable versions prior to 3.0.0 in default deployments that expose the HTTP handler; the only real limiter is network reachability of the Parseable endpoint. The post-fix code additionally restricts this parsing to the Ingest action, indicating pre-fix it was reachable more broadly. |
| Impact | This is a genuine but narrow-impact issue whose signals are internally consistent: the vendor CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) describes a pure availability flaw, and CWE-248 (uncaught exception) matches the source evidence - pre-3.0.0 middleware.rs uses unwrap() on the x-amz-firehose-common-attributes header (to_str(), serde_json::from_str, HeaderValue::from_str) BEFORE authentication, so any of the three failure modes (non-UTF-8 bytes, malformed JSON, or a derived value that is not a valid header) triggers a Rust panic. The 'high-CVSS' here is real for availability but there is no confidentiality or integrity exposure, so despite the input's 'Information Disclosure' tag this is NOT an info-disclosure bug (C:N/I:N in the vector confirms this - the tag is mislabeled). No EPSS score, no CISA KEV entry, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis, though the panic condition is trivial to reproduce from the described inputs. Net: prioritize for anyone running an internet-exposed Parseable ingest endpoint (easy, unauthenticated, pre-auth DoS), but the blast radius is availability-only and the product footprint is niche, so it is not a broad-ecosystem emergency. |
| Exploit ScenarioDerived | An attacker who can reach a Parseable HTTP endpoint sends a request carrying an x-amz-firehose-common-attributes header containing non-UTF-8 bytes or malformed JSON; the pre-authentication middleware calls unwrap() on the parse result and panics, aborting request handling. Repeating the request keeps crashing request handling and can drive the container into a restart loop, denying service to legitimate log ingestion. No public exploit code is identified, but the trigger is trivial and requires no credentials (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
RemediationAI
Upgrade to Parseable 3.0.0 or later, which is the vendor-released patched version: the fix replaces the unwrap() chain in src/handlers/http/middleware.rs with safe let-else/if-let matching and restricts Firehose common-attributes parsing to the Ingest action. Because 3.0.0 also bumps storage metadata from v6 to v8, take a snapshot and validate rollback compatibility before upgrading in production. If immediate upgrade is not possible, place the Parseable HTTP ingestion endpoint behind a reverse proxy or API gateway and reject or strip any request whose x-amz-firehose-common-attributes header is present on non-ingest paths or fails strict UTF-8/JSON validation; this neutralizes the panic but requires maintaining header-filtering rules as ingestion clients change. Additionally, restrict network reachability of the Parseable listener to trusted ingestion sources via firewall or service mesh policy, and configure container orchestration (for example Kubernetes restart backoff and liveness probe thresholds) to avoid tight restart loops if a crash occurs. Consult the advisory at https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx and review PR https://github.com/parseablehq/parseable/pull/1581 for the precise code changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Parseable is a Rust-based log analytics platform that ingests high-volume event streams, including via an AWS Kinesis Firehose-compatible endpoint. The vulnerable code path is the HTTP middleware in src/handlers/http/middleware.rs, which reads the x-amz-firehose-common-attributes header (a Firehose convention for carrying authorization and stream metadata) and then chains three fallible conversions using unwrap(): HeaderValue::to_str() to obtain a &str, serde_json::from_str::<Message>() to deserialize the embedded JSON, and HeaderValue::from_str() to rebuild the derived authorization and x-p-stream headers. Any failure in that chain - invalid UTF-8 bytes, JSON that does not deserialize into the Message struct, or a derived string that is not a legal HTTP header value - causes a Rust panic, which in the Tokio/Axum-style request task is an uncaught exception (CWE-248) that aborts request handling. Critically, this parsing occurs before the authentication middleware runs, so the panic is reachable without credentials, and the fix additionally narrows execution to the Ingest action, implying the pre-3.0.0 code path was reachable across a broader set of actions. The accompanying change to CURRENT_STORAGE_METADATA_VERSION (v6 to v8) in src/storage/store_metadata.rs indicates the 3.0.0 release is a significant storage-format bump rather than a surgical hotfix, which is relevant when planning upgrades and rollbacks.
Know when Parseable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity header input triggers a pre-auth panic (AV:N/AC:L/PR:N/UI:N); impact is availability-only with no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.
Technical POC Analysis
Bug class: CWE-248 (Uncaught Exception), secondarily CWE-703.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Parseable deployments older than 3.0.0 are exposed to a remotely triggerable crash in the HTTP ingestion endpoint, where a single malformed request header can break request handling and sustained traffic can drive the service into a restart loop. Because the vulnerable code path executes before any credential check, any host that can reach the ingestion port - internal systems, partner integrations, or internet-facing endpoints - can disrupt data ingestion without needing an account or user interaction. Leadership should treat this as an availability and operational-resilience risk for teams that depend on Parseable for logs and observability, rather than a data-confidentiality issue.
No vendor-released patch is identified in the structured patch data (the vulnerability context, however, names Parseable 3.0.0 as the vendor-released fix - verify with the vendor before relying on it). Until patched: restrict network reachability of the HTTP ingestion endpoint to trusted sources; front the endpoint with a reverse proxy or WAF that enforces header size, UTF-8, and JSON validation and strips or rejects unexpected x-amz-firehose-common-attributes, authorization, and x-p-stream values; apply aggressive rate limiting per source; configure container restart backoff and alerting to prevent or surface restart loops; and monitor ingestion availability and error rates for early detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB