What is the CVSS score of CVE-2026-5758?

CVE-2026-5758 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-5758?

Yes, a patch is available for CVE-2026-5758. Update the affected software to the latest version immediately.

Red Hat CVE-2026-5758

EUVD-2026-22993 MEDIUM

2026-04-15 certcc

RCE Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:17 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.1

CVSS changed

Apr 15, 2026 - 20:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 17:45 euvd

EUVD-2026-22993

CVE Published

Apr 15, 2026 - 17:20 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

23,657 npm packages depend on protocol-buffers-schema (74 direct, 23,592 indirect)

Ecosystem-wide dependent count for version 3.6.1.

DescriptionCVE.org

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.