EUVD-2026-35369
GHSA-v553-g2w6-295p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Denial-of-service via crafted TIFF image upload in Apache Answer through 2.0.0 allows an authenticated user to crash the server process by triggering excessive memory allocation during image decoding. The vulnerability stems from improper handling of specially crafted TIFF files in the file upload feature, where no bounds are placed on memory consumed during the decode phase. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The file upload feature in Apache Answer must be accessible to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided, so quantitative scoring cannot be confirmed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user on an Apache Answer instance running version 2.0.0 or earlier uploads a specially crafted TIFF file - for example, one with malformed image dimensions that direct the decoder to allocate gigabytes of memory. The server's image decoding process consumes all available memory, causing the Answer server process to crash and rendering the platform unavailable to all users until it is restarted. … |
| Remediation | The primary fix is to upgrade Apache Answer to version 2.0.1, which resolves the excessive memory allocation issue during TIFF decoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Disable TIFF file uploads in Apache Answer 2.0.0 or implement strict file type allowlists; restrict upload permissions to essential users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today