High
Security advisory
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-23930
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:30 UTC · Revision 1
Source evidence
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
osv:CVE-2026-23930
Complete source record
{
"id": "ad6df413a989e90e059eb6b8d9a4888524d4dcfe20236a3e8a042f0edd234dd4",
"url": "https://osv.dev/vulnerability/CVE-2026-23930",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-23930",
"summary": "An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.",
"evidence": "osv:CVE-2026-23930",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-23930",
"aliases": [
"CVE-2026-23930"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zabbix/zabbix",
"type": "GIT",
"events": [
{
"introduced": "5203d2ea7d901cd33d148f20586e2155901a7faa"
},
{
"fixed": "39db3e7dce42aca1f772888804eb3280627347f0"
},
{
"introduced": "49955f1fb5c9168a8a24b053f7ade6b3d903143c"
},
{
"fixed": "e4b2990bfed4d08d711394444097a5ff4772466d"
},
{
"introduced": "372a4e93c48ecd25aa666949a055a02369031861"
},
{
"fixed": "a6a1f80f9dd9c9461513853ecabc5b1a6c7dd521"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.47"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.11"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"6.0.47rc1",
"7.4.11rc2",
"7.4.11rc1",
"7.0.27rc1",
"6.0.46",
"7.0.26",
"7.4.10",
"7.4.10rc1",
"7.0.26rc1",
"6.0.46rc1",
"7.4.9",
"7.0.25",
"7.4.9rc1",
"7.0.25rc1",
"6.0.45",
"7.4.8",
"7.0.24",
"7.4.8rc3",
"7.0.24rc3",
"7.4.8rc2",
"7.0.24rc2",
"6.0.45rc1",
"7.4.8rc1",
"7.0.24rc1",
"6.0.44",
"7.0.23",
"7.4.7",
"7.4.7rc3",
"7.4.7rc2",
"6.0.44rc1",
"7.0.23rc2",
"7.0.23rc1",
"7.4.7rc1",
"7.4.6",
"7.0.22",
"6.0.43",
"7.0.22rc3",
"6.0.43rc1",
"7.4.6rc2",
"7.4.6rc1",
"7.0.22rc2",
"7.0.22rc1",
"7.0.20",
"7.0.21",
"7.4.5",
"7.4.4",
"7.0.20rc1",
"7.4.4rc1",
"7.0.19",
"7.4.3",
"6.0.42",
"7.4.3rc1",
"7.0.19rc1",
"6.0.42rc1",
"7.4.2",
"7.0.18",
"6.0.41",
"7.0.18rc2",
"7.4.2rc2",
"7.0.18rc1",
"7.4.2rc1",
"6.0.41rc1",
"7.4.1",
"7.0.17",
"7.4.1rc1",
"7.0.17rc2",
"7.0.17rc1",
"7.0.16",
"7.0.15",
"7.4.0",
"7.0.14",
"7.0.14rc1",
"6.0.39",
"7.0.13",
"7.0.13rc1",
"6.0.40",
"7.0.12",
"7.0.12rc1",
"7.0.11",
"7.0.11rc2",
"7.0.11rc1",
"6.0.40rc1",
"7.0.10",
"7.0.10rc1",
"6.0.39rc1",
"6.0.38",
"7.0.9",
"7.0.9rc2",
"6.0.38rc1",
"7.0.9rc1",
"7.0.8",
"7.0.8rc2",
"7.0.8rc1",
"7.0.7",
"7.0.7rc1",
"7.0.6",
"7.0.6rc1",
"6.0.37",
"6.0.37rc1",
"6.0.36",
"6.0.36rc1",
"6.0.35",
"7.0.5",
"6.0.35rc1",
"7.0.5rc1",
"6.0.34",
"6.0.34rc2",
"7.0.4",
"7.0.4rc1",
"6.0.34rc1",
"7.0.3",
"6.0.33rc1",
"6.0.33",
"7.0.3rc1",
"7.0.2",
"7.0.2rc2",
"7.0.2rc1",
"7.0.1",
"7.0.1rc2",
"6.0.32",
"7.0.1rc1",
"6.0.32rc1",
"6.0.31",
"6.0.31rc1",
"7.0.0",
"6.0.30",
"6.0.30rc1",
"6.0.29",
"6.0.29rc1",
"6.0.28",
"6.0.28rc1",
"6.0.27rc1",
"6.0.27",
"6.0.26",
"6.0.26rc1",
"6.0.25",
"6.0.25rc1",
"6.0.23",
"6.0.23rc1",
"6.0.22",
"6.0.22rc1",
"6.0.21",
"6.0.21rc1",
"6.0.20",
"6.0.20rc1",
"6.0.19",
"6.0.19rc1",
"6.0.18rc1",
"6.0.18",
"6.0.17",
"6.0.17rc2",
"6.0.17rc1",
"6.0.16",
"6.0.16rc1",
"6.0.15",
"6.0.15rc2",
"6.0.15rc1",
"6.0.14",
"6.0.14rc2",
"6.0.14rc1",
"6.0.13",
"6.0.13rc1",
"6.0.12",
"6.0.12rc2",
"6.0.12rc1",
"6.0.11",
"6.0.11rc2",
"6.0.11rc1",
"6.0.10rc1",
"6.0.10",
"6.0.10rc2",
"6.0.9",
"6.0.9rc2",
"6.0.9rc1",
"6.0.8",
"6.0.8rc2",
"6.0.8rc1",
"6.0.7",
"6.0.1",
"6.0.7rc1",
"6.0.6",
"6.0.6rc1",
"6.0.5",
"6.0.5rc1",
"6.0.4",
"6.0.4rc1",
"6.0.3",
"6.0.3rc1",
"6.0.2",
"6.0.2rc1",
"6.0.1rc4",
"6.0.1rc3",
"6.0.1rc2",
"6.0.1rc1",
"6.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23930.json",
"vanir_signatures": [
{
"id": "CVE-2026-23930-87d0c2f8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"61950285254057822375511809511230316649",
"202208457591449445730552017254530970731",
"22806171998387866034443206406648060655",
"124374908236790130710091146456556061826",
"210859921065700170806321554218079188008",
"230192658099312171426732252572302441243"
]
},
"source": "https://github.com/zabbix/zabbix/commit/39db3e7dce42aca1f772888804eb3280627347f0",
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-23930-a8156f50",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80225613835803133910910126596852952088",
"230058783349080063223687654489728332059",
"177878195683979894346014332267148188511",
"188349145695577399953969866264285031573",
"329342636515519127775980169026149266987",
"58272670197979715614362102333779585045"
]
},
"source": "https://github.com/zabbix/zabbix/commit/a6a1f80f9dd9c9461513853ecabc5b1a6c7dd521",
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-23930-d94b113d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333406838192985303553783787161722961189",
"156129663047399997922495101387796055769",
"252626966670648624700598000650461445114",
"188642116474187757724379112141936471334",
"191132183165099214826289054637735751046",
"170621029598218961559184615347454783088"
]
},
"source": "https://github.com/zabbix/zabbix/commit/e4b2990bfed4d08d711394444097a5ff4772466d",
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:58:39Z"
}
}
],
"modified": "2026-10-24T14:58:39.906919757Z",
"provider": "osv",
"references": [
"https://support.zabbix.com/browse/ZBX-28069"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-23930",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443906,
"published_at": "2026-08-18T13:17:21.303+00:00"
}