EUVD-2026-42274
GHSA-hf7w-mcpw-97mf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack requires a local malicious project .ackrc and the victim running ack (AV:L, UI:R), no privileges (PR:N), availability-only impact from memory exhaustion (C:N/I:N/A:H).
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
7DescriptionCVE.org
Alpine Linux: ack fixed in 3.10.0-r0
AnalysisAI
Denial of service in the ack code-search tool (App::Ack / ack3) before v3.10.0 allows a project-scoped .ackrc file to trigger memory exhaustion by setting an unbounded -A/-B/-C context value. When a victim runs ack inside a directory containing an attacker-supplied .ackrc, the oversized context request forces unbounded buffering and can exhaust process/host memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker-controlled project-level .ackrc file in a directory the victim searches, containing an -A, -B, or -C context option set to a very large value (the fix rejects values above 10,000). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) scores this as a network, unauthenticated, availability-only issue, but that conflicts with the actual mechanism: the trigger is a local project .ackrc file and a victim who runs ack in that directory - verify with vendor, because this is realistically a local, user-interaction-dependent attack (closer to AV:L/UI:R), which lowers real-world severity below what 7.5 implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: ack v3.10.0 (Alpine package ack-3.10.0-r0) - upgrade to this version or later, which caps -A/-B/-C context values at 10,000 and aborts with an error when exceeded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running ack, including CI/CD servers, development workstations, and container images. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today