Parseable
Monthly
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.