What is the CVSS score of CVE-2026-33582?

CVE-2026-33582 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Answer are affected by CVE-2026-33582?

Apache Answer versions through 2.0.0 are vulnerable to denial-of-service attacks through authenticated TIFF image uploads.. A patch is available.

How to fix or mitigate CVE-2026-33582?

24 hours: Disable TIFF file uploads in Apache Answer 2.0.0 or implement strict file type allowlists; restrict upload permissions to essential users only. 7 days: Implement file size limits (≤50MB recommended) on upload endpoints; enable monitoring for service crashes and memory exhaustion events. 30 days: Subscribe to Apache Answer security advisories for patch availability; develop and validate upgrade plan to patched version upon release.

Apache Answer CVE-2026-33582

EUVD-2026-35369 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-09

GHSA-v553-g2w6-295p

File Upload Apache Answer

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 08:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical DoS in Apache Answer 2.0.0 via Crafted TIFF Upload - CVE-2026-33582 Jun 09, 2026

AnalysisAI

Denial-of-service via crafted TIFF image upload in Apache Answer through 2.0.0 allows an authenticated user to crash the server process by triggering excessive memory allocation during image decoding. The vulnerability stems from improper handling of specially crafted TIFF files in the file upload feature, where no bounds are placed on memory consumed during the decode phase. No public exploit code or active exploitation has been identified at time of analysis; however, the low technical barrier to trigger the crash once authenticated elevates its operational risk for community and enterprise deployments.

Technical ContextAI

Apache Answer is an open-source Q&A platform (GitHub: 15.5k stars) designed for community forums, help centers, and knowledge management. The vulnerability lies in its file upload handling pipeline, specifically in how TIFF image files are decoded server-side. TIFF is a complex image format that can embed metadata and encoding parameters capable of requesting arbitrarily large memory allocations during decompression (e.g., via malformed image dimensions, strip byte counts, or tile structures). This class of vulnerability - where a parsing library honors user-supplied size fields without capping allocation - is consistent with CWE-400 (Uncontrolled Resource Consumption) and CWE-434 (Unrestricted Upload of File with Dangerous Type), the latter being the CWE classification cited in the advisory. The affected versions are Apache Answer through 2.0.0. No CPE string was provided in the source data.

RemediationAI

The primary fix is to upgrade Apache Answer to version 2.0.1, which resolves the excessive memory allocation issue during TIFF decoding. The vendor advisory at https://answer.apache.org and the oss-security post at https://seclists.org/oss-sec/2026/q2/851 both confirm 2.0.1 as the minimum safe version. If an immediate upgrade is not feasible, a specific compensating control is to restrict or disable TIFF file uploads in the application's allowed MIME type or file extension configuration - this removes the attack surface entirely at the cost of preventing TIFF image sharing. Alternatively, placing the Answer server behind a reverse proxy with request body size limits (e.g., nginx client_max_body_size) can reduce but not eliminate the risk, as a small TIFF file can still trigger large allocations via compression bomb techniques. Restricting upload permissions to trusted user roles (moderators or admins only) is an additional partial mitigation if broader file upload restriction is undesirable.