EUVD-2026-42288
GHSA-c2rv-g977-2fxr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ack is a locally-run CLI, so realistic exploitation is local (AV:L) and requires the victim to run it against attacker-supplied content (UI:R); impact is availability-only per the source, with no confidentiality/integrity effect.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
Alpine Linux: ack fixed in 3.10.0-r0
AnalysisAI
Denial-of-service / file-path abuse affects the ack source-code search tool (Perl App::Ack) in all versions up to and including 3.10.0, packaged in Alpine Linux as 'ack' prior to 3.10.0-r0. Rooted in CWE-73 (External Control of File Name or Path), the flaw is tagged as Information Disclosure yet carries an availability-only CVSS impact (A:H), so the concrete effect is ambiguous from the source data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVE description and references do not spell out the trigger, but CWE-73 plus the ack architecture imply the victim must run ack against attacker-influenced input - i.e., execute the tool inside a directory tree that contains attacker-controlled files, symlinks, or a malicious project .ackrc/ACK_OPTIONS configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) rates this as a high-severity, remotely-triggerable availability issue, but that vector is internally inconsistent with the nature of the product: ack is a locally-run developer CLI, not a network service, so a genuine AV:N/UI:N path is doubtful and should be verified with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer clones or downloads an untrusted repository and runs ack inside it to search the code; a maliciously crafted file, symlink, or project configuration in that tree causes ack to open an unintended path or consume excessive resources, degrading availability on the developer's host. No public POC is referenced, and the attack requires the victim to run ack against attacker-supplied content. |
| Remediation | Upgrade ack to version 3.10.0 or later; on Alpine Linux specifically install package version 3.10.0-r0 or newer (Vendor-released patch: ack 3.10.0 / Alpine 3.10.0-r0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Alpine Linux systems and containers running ack versions prior to 3.10.0-r0, including CI/CD infrastructure and developer workstations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today