What is the CVSS score of CVE-2026-50882?

CVE-2026-50882 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of anna-is-cute paste are affected by CVE-2026-50882?

The anna-is-cute paste service v0.1.1 contains a denial-of-service vulnerability allowing remote unauthenticated attackers to disrupt service availability by overwhelming the /api/v0/pastes endpoint.

How to fix or mitigate CVE-2026-50882?

Within 24 hours: Identify all anna-is-cute paste v0.1.1 instances and implement API rate limiting on the /api/v0/pastes POST endpoint. Within 7 days: Deploy WAF rules to restrict POST request volume to /api/v0/pastes, isolate service behind reverse proxy with DoS protection, and enable comprehensive logging for exploitation attempts. Within 30 days: Monitor vendor advisory channels for patch availability; evaluate migration to patched version or alternative paste solution with stronger security baseline.

anna-is-cute paste CVE-2026-50882

EUVD-2026-36780 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-15 mitre

GHSA-pr7v-rh2m-6hf3

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Endpoint is network-reachable and unauthenticated with no user interaction; single crafted POST causes DoS, so availability High and confidentiality/integrity None.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:33 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

AnalysisAI

Denial of service in anna-is-cute paste v0.1.1 allows remote unauthenticated attackers to disrupt service availability by sending a crafted POST request to the /api/v0/pastes endpoint. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 with availability-only impact; no public exploit identified at time of analysis, and EPSS is low at 0.15% (4th percentile), suggesting minimal observed interest. The vulnerability is not listed in CISA KEV.

Technical ContextAI

anna-is-cute paste is a small pastebin-style web application exposing a REST API under /api/v0/pastes for creating paste resources via HTTP POST. CWE-400 (Uncontrolled Resource Consumption) indicates the endpoint fails to enforce limits on input size, request rate, parser depth, or backend resource usage, allowing a malformed or oversized POST body to exhaust CPU, memory, or other finite resources and crash or hang the service. The provided CPE string ('cpe:2.3:a:n/a:n/a:*') is a placeholder and does not authoritatively identify the vendor/product in NVD's dictionary, so identification relies on the textual description and the linked GitHub gist proof.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed version is referenced in the available data. Operators running anna-is-cute paste v0.1.1 should monitor the upstream project repository for an updated release and review the referenced gist (https://gist.github.com/pyuysig/e5b8c018b2d323b0b4ddffb9ebce9a80) for technical details of the crafted POST request so detective controls can be tuned. As compensating controls, place the /api/v0/pastes endpoint behind a reverse proxy or WAF that enforces a strict maximum request body size, limits Content-Length, and applies per-IP rate limiting (trade-off: legitimate large pastes will be rejected); require authentication on the endpoint via the proxy if the deployment allows it (trade-off: breaks anonymous paste workflows); and restrict network exposure of the API to trusted networks until an upstream fix lands. Refer to the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50882 for advisory tracking.