What is the CVSS score of EUVD-2026-55224?

EUVD-2026-55224 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of fastschema are affected by EUVD-2026-55224?

fastschema through version 0.15.1 is vulnerable to unauthenticated remote denial-of-service attacks via its password-recovery endpoint, allowing attackers to crash the entire server process with a…. A patch is available.

How to fix or mitigate EUVD-2026-55224?

Within 24 hours, identify and inventory all fastschema deployments through v0.15.1 and determine whether the password-recovery endpoint is internet-accessible. Within 7 days, implement rate limiting on the password-recovery endpoint (max 5 requests per IP per minute), deploy Web Application Firewall rules to filter malformed requests, disable the password-recovery feature if operationally unnecessary, and activate monitoring and alerting on this endpoint. Within 30 days, monitor vendor advisories for patch release announcements, develop and test an upgrade plan to patched versions once available, and finalize incident response procedures to rapidly contain and recover from exploitation.

fastschema EUVD-2026-55224

| CVE-2026-72582 HIGH

NULL Pointer Dereference (CWE-476)

2026-08-10 TuranSec

GHSA-x3w9-j9j5-qcw7

Denial Of Service Null Pointer Dereference Fastschema

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated endpoint, no complexity or interaction required; impact is solely complete availability loss via process termination.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:24 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

AnalysisAI

NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.

Technical ContextAI

fastschema is a Go-based content management and schema framework (CPE: cpe:2.3:a:fastschema:fastschema:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-476 (NULL Pointer Dereference). In Go, a nil pointer dereference causes a runtime panic that, if unrecovered, terminates the entire process. The affected code path in pkg/auth/local.go - specifically the sendOTPEmail function invoked by the /api/auth/local/recover endpoint - fails to validate the return value of an operation that can produce a nil pointer on an error path. Because the panic is not caught by a recovery handler, it propagates and kills the server process rather than returning an HTTP error to the client. The root cause is a missing nil-check on a value derived from a fallible operation, a common Go programming error when error returns are ignored or handled incompletely.

RemediationAI

No vendor-released patched version has been independently confirmed from the available reference data; consumers should monitor the upstream repository at https://github.com/fastschema/fastschema for a tagged release addressing this nil-check deficiency in pkg/auth/local.go. As an immediate compensating control, operators should restrict network access to the /api/auth/local/recover endpoint via firewall rules, reverse proxy ACLs, or API gateway policies, blocking unauthenticated access from untrusted networks - note this may disable password recovery functionality for legitimate users. If the local authentication provider is not required, disabling it entirely removes the vulnerable code path with no availability trade-off beyond loss of local-auth capability. Process supervisors (systemd, Kubernetes restart policies) should be configured to automatically restart the fastschema process after a crash to minimize downtime if exploitation occurs before a patch is applied, though this does not prevent repeated denial-of-service attacks.