High
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
Type: advisorySources: OSV
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-63462
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 09:42 UTC · Revision 1
Source evidence
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
core-osv · Original sourcePublished 21 Aug 2026, 18:12 UTC
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
osv:CVE-2026-63462
Complete source record
{
"id": "27df9ee0b71bbb7c3a48ff2766e5d1e074cb1f4c47a52779a793229c6527ec30",
"url": "https://osv.dev/vulnerability/CVE-2026-63462",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",
"summary": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.",
"evidence": "osv:CVE-2026-63462",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-63462",
"aliases": [
"CVE-2026-63462",
"GHSA-r5pq-6chh-j3xp"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/unleash/unleash",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b4d1bf8917a8059ffb9eb32f11af6bc1473a7782"
},
{
"introduced": "e3e6336fafaddebc8c7afbc12bbf08566a80b853"
},
{
"fixed": "b501005d1d9961605e9c7b5333d17c8ca14579f1"
},
{
"introduced": "7e69bb26a137a38bb420c3c3238888cb6c411227"
},
{
"fixed": "8ee9e914cec88ee18e7677f41a84db7c8eeda8fb"
},
{
"fixed": "b0e4da63249a9403bc209e0581db223326cb8dcf"
},
{
"fixed": "d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"
},
{
"fixed": "d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "7.5.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "7.6.0"
},
{
"fixed": "7.6.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "b0e4da63249a9403bc209e0581db223326cb8dcf"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b4d1bf8917a8059ffb9eb32f11af6bc1473a7782"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v7.5.2"
},
{
"range": [
{
"fixed": "b501005d1d9961605e9c7b5333d17c8ca14579f1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v7.6.5"
},
{
"range": [
{
"fixed": "8ee9e914cec88ee18e7677f41a84db7c8eeda8fb"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.0.2"
}
]
}
}
],
"versions": [
"v7.5.1",
"v7.6.4",
"v8.0.1",
"v8.0.0",
"v7.6.3",
"v7.6.2",
"v7.6.1",
"v7.6.0",
"v7.5.0",
"v7.4.3",
"v7.4.2",
"v7.4.1",
"v7.4.0",
"v7.3.0",
"v7.2.3",
"v7.2.0",
"v7.1.2",
"v7.1.1",
"v7.1.0",
"v7.0.6",
"v7.0.5",
"v7.0.4",
"v7.0.3",
"v7.0.2",
"v7.0.1",
"v7.0.0",
"v6.10.0",
"v6.9.2",
"v6.9.1",
"v6.9.0",
"v6.8.0",
"v6.7.2",
"v6.7.1",
"v6.7.0",
"v6.6.0",
"v6.5.2",
"v6.5.0",
"v6.5.1",
"v5.1.0-beta.54",
"v5.1.0-beta.53",
"v5.1.0-beta.52",
"v5.1.0-beta.51",
"v5.1.0-beta.50",
"v5.1.0-beta.49",
"v5.1.0-beta.48",
"v5.1.0-beta.47",
"v5.1.0-beta.46",
"v5.1.0-beta.45",
"v5.1.0-beta.44",
"v5.1.0-beta.43",
"v5.1.0-beta.42",
"v5.1.0-beta.41",
"v5.1.0-beta.40",
"v5.1.0-beta.39",
"v5.1.0-beta.38",
"v5.1.0-beta.37",
"v5.1.0-beta.36",
"v5.1.0-beta.35",
"v5.1.0-beta.34",
"v5.1.0-beta.33",
"v5.1.0-beta.31",
"v5.1.0-beta.30",
"v5.1.0-beta.29",
"v5.1.0-beta.28",
"v5.1.0-beta.27",
"v5.1.0-beta.26",
"v5.1.0-beta.25",
"v5.1.0-beta.24",
"v5.1.0-beta.23",
"v5.1.0-beta.22",
"v5.1.0-beta.21",
"v5.1.0-beta.20",
"v5.1.0-beta.19",
"v5.1.0-beta.18",
"v5.1.0-beta.17",
"v5.1.0-beta.16",
"v5.1.0-beta.15",
"v5.1.0-beta.14",
"v5.1.0-beta.13",
"v5.1.0-beta.12",
"v5.1.0-beta.11",
"v5.1.0-beta.10",
"v5.1.0-beta.9",
"v5.1.0-beta.8",
"v5.1.0-beta.7",
"v5.1.0-beta.6",
"v5.1.0-beta.5",
"v5.1.0-beta.4",
"v5.1.0-beta.3",
"v5.1.0-beta.2",
"v5.1.0-beta.1",
"v5.1.0-beta.0",
"v5.0.0",
"v5.0.0-beta.2",
"v5.0.0-beta.1",
"v4.23.0-beta.84",
"v4.23.0-beta.83",
"v4.23.0-beta.82",
"v4.23.0-beta.81",
"v4.23.0-beta.80",
"v4.23.0-beta.79",
"v4.23.0-beta.78",
"v4.23.0-beta.77",
"v4.23.0-beta.76",
"v4.23.0-beta.75",
"v4.23.0-beta.74",
"v4.23.0-beta.73",
"v4.23.0-beta.72",
"v4.23.0-beta.71",
"v4.23.0-beta.70",
"v4.23.0-beta.69",
"v4.23.0-beta.68",
"v4.23.0-beta.67",
"v4.23.0-beta.66",
"v4.23.0-beta.65",
"v4.23.0-beta.64",
"v4.23.0-beta.63",
"v4.23.0-beta.62",
"v4.23.0-beta.61",
"v4.23.0-beta.60",
"v4.23.0-beta.59",
"v4.23.0-beta.58",
"v4.23.0-beta.57",
"v4.23.0-beta.56",
"v4.23.0-beta.55",
"v4.23.0-beta.54",
"v4.23.0-beta.53",
"v4.23.0-beta.52",
"v4.23.0-beta.51",
"v4.23.0-beta.50",
"v4.23.0-beta.49",
"v4.23.0-beta.48",
"v4.23.0-beta.47",
"v4.23.0-beta.46",
"v4.23.0-beta.45",
"v4.23.0-beta.44",
"v4.23.0-beta.43",
"v4.23.0-beta.42",
"v4.23.0-beta.41",
"v4.23.0-beta.40",
"v4.23.0-beta.39",
"v4.23.0-beta.38",
"v4.23.0-beta.37",
"v4.23.0-beta.36",
"v4.23.0-beta.35",
"v4.23.0-beta.34",
"v4.23.0-beta.33",
"v4.23.0-beta.32",
"v4.23.0-beta.30",
"v4.23.0-beta.31",
"v4.23.0-beta.29",
"v4.23.0-beta.28",
"v4.23.0-beta.27",
"v4.23.0-beta.26",
"v4.23.0-beta.25",
"v4.23.0-beta.24",
"v4.23.0-beta.23",
"v4.23.0-beta.22",
"v4.23.0-beta.21",
"v4.23.0-beta.20",
"v4.23.0-beta.19",
"v4.23.0-beta.18",
"v4.23.0-beta.17",
"v4.23.0-beta.16",
"v4.23.0-beta.15",
"v4.23.0-beta.12",
"v4.23.0-beta.14",
"v4.23.0-beta.13",
"v4.23.0-beta.11",
"v4.23.0-beta.10",
"v4.23.0-beta.9",
"v4.23.0-beta.8",
"v4.23.0-beta.7",
"v4.23.0-beta.6",
"v4.23.0-beta.5",
"v4.22.0",
"v4.23.0-beta.4",
"v4.23.0-beta.3",
"v4.23.0-beta.2",
"v4.23.0-beta.1",
"v4.23.0-beta.0",
"v4.22.0-beta.141",
"v4.22.0-beta.140",
"v4.22.0-beta.139",
"v4.22.0-beta.138",
"v4.22.0-beta.137",
"v4.22.0-beta.136",
"v4.22.0-beta.135",
"v4.22.0-beta.134",
"v4.22.0-beta.133",
"v4.22.0-beta.132",
"v4.22.0-beta.131",
"v4.22.0-beta.130",
"v4.22.0-beta.129",
"v4.22.0-beta.128",
"v4.22.0-beta.127",
"v4.22.0-beta.126",
"v4.22.0-beta.125",
"v4.22.0-beta.124",
"v4.22.0-beta.123",
"v4.22.0-beta.122",
"v4.22.0-beta.121",
"v4.22.0-beta.120",
"v4.22.0-beta.119",
"v4.22.0-beta.118",
"v4.22.0-beta.117",
"v4.22.0-beta.116",
"v4.22.0-beta.115",
"v4.22.0-beta.114",
"v4.22.0-beta.113",
"v4.22.0-beta.112",
"v4.22.0-beta.111",
"v4.22.0-beta.110",
"v4.22.0-beta.109",
"v4.22.0-beta.108",
"v4.22.0-beta.107",
"v4.22.0-beta.106",
"v4.21.0",
"v4.22.0-beta.105",
"v4.22.0-beta.104",
"v4.22.0-beta.103",
"v4.22.0-beta.102",
"v4.22.0-beta.101",
"v4.22.0-beta.100",
"v4.22.0-beta.99",
"v4.22.0-beta.98",
"v4.22.0-beta.97",
"v4.22.0-beta.96",
"v4.22.0-beta.95",
"v4.22.0-beta.94",
"v4.22.0-beta.93",
"v4.22.0-beta.92",
"v4.22.0-beta.91",
"v4.22.0-beta.90",
"v4.22.0-beta.89",
"v4.22.0-beta.88",
"v4.22.0-beta.87",
"v4.22.0-beta.86",
"v4.22.0-beta.85",
"v4.22.0-beta.84",
"v4.22.0-beta.83",
"v4.22.0-beta.82",
"v4.22.0-beta.81",
"v4.22.0-beta.80",
"v4.22.0-beta.79",
"v4.22.0-beta.78",
"v4.22.0-beta.77",
"v4.22.0-beta.76",
"v4.22.0-beta.75",
"v4.22.0-beta.74",
"v4.22.0-beta.73",
"v4.22.0-beta.72",
"v4.22.0-beta.71",
"v4.22.0-beta.70",
"v4.22.0-beta.69",
"v4.22.0-beta.68",
"v4.22.0-beta.67",
"v4.22.0-beta.66",
"v4.22.0-beta.65",
"v4.22.0-beta.64",
"v4.22.0-beta.63",
"v4.22.0-beta.62",
"v4.22.0-beta.61",
"v4.22.0-beta.60",
"v4.22.0-beta.59",
"v4.22.0-beta.58",
"v4.22.0-beta.57",
"v4.22.0-beta.56",
"v4.22.0-beta.55",
"v4.22.0-beta.54",
"v4.22.0-beta.53",
"v4.22.0-beta.52",
"v4.22.0-beta.51",
"v4.22.0-beta.50",
"v4.22.0-beta.49",
"v4.22.0-beta.48",
"v4.22.0-beta.47",
"v4.22.0-beta.46",
"v4.22.0-beta.45",
"v4.22.0-beta.44",
"v4.22.0-beta.43",
"v4.22.0-beta.42",
"v4.22.0-beta.41",
"v4.22.0-beta.40",
"v4.22.0-beta.39",
"v4.22.0-beta.38",
"v4.22.0-beta.37",
"v4.22.0-beta.36",
"v4.22.0-beta.35",
"v4.22.0-beta.33",
"v4.22.0-beta.34",
"v4.22.0-beta.32",
"v4.22.0-beta.31",
"v4.22.0-beta.30",
"v4.22.0-beta.29",
"v4.22.0-beta.28",
"v4.22.0-beta.27",
"v4.22.0-beta.26",
"v4.22.0-beta.25",
"v4.22.0-beta.24",
"v4.22.0-beta.23",
"v4.22.0-beta.22",
"v4.22.0-beta.21",
"v4.22.0-beta.20",
"v4.22.0-beta.19",
"v4.22.0-beta.18",
"v4.22.0-beta.17",
"v4.22.0-beta.16",
"v4.22.0-beta.15",
"v4.22.0-beta.14",
"v4.22.0-beta.13",
"v4.22.0-beta.12",
"v4.22.0-beta.11",
"v4.22.0-beta.10",
"v4.22.0-beta.9",
"v4.22.0-beta.8",
"v4.22.0-beta.7",
"v4.22.0-beta.6",
"v4.22.0-beta.5",
"v4.22.0-beta.4",
"v4.22.0-beta.3",
"v4.22.0-beta.2",
"v4.22.0-beta.1",
"v4.21.1-beta.0",
"v4.21.0-beta.57",
"v4.21.0-beta.56",
"v4.21.0-beta.55",
"v4.21.0-beta.54",
"v4.21.0-beta.53",
"v4.21.0-beta.52",
"v4.21.0-beta.51",
"v4.21.0-beta.50",
"v4.21.0-beta.49",
"v4.21.0-beta.48",
"v4.21.0-beta.47",
"v4.21.0-beta.46",
"v4.21.0-beta.45",
"v4.21.0-beta.44",
"v4.21.0-beta.43",
"v4.21.0-beta.42",
"v4.21.0-beta.41",
"v4.21.0-beta.40",
"v4.21.0-beta.39",
"v4.21.0-beta.38",
"v4.21.0-beta.37",
"v4.21.0-beta.36",
"v4.21.0-beta.35",
"v4.21.0-beta.34",
"v4.21.0-beta.33",
"v4.21.0-beta.32",
"v4.21.0-beta.31",
"v4.21.0-beta.30",
"v4.21.0-beta.29",
"v4.21.0-beta.28",
"v4.21.0-beta.27",
"v4.21.0-beta.26",
"v4.21.0-beta.25",
"v4.21.0-beta.24",
"v4.21.0-beta.23",
"v4.21.0-beta.22",
"v4.21.0-beta.21",
"v4.21.0-beta.20",
"v4.21.0-beta.19",
"v4.21.0-beta.18",
"v4.21.0-beta.17",
"v4.21.0-beta.16",
"v4.21.0-beta.15",
"v4.21.0-beta.8",
"v4.21.0-beta.7",
"v4.21.0-beta.6",
"v4.21.0-beta.5",
"v4.21.0-beta.4",
"v4.21.0-beta.3",
"v4.21.0-beta.2",
"v4.21.0-beta.1",
"v4.21.0-beta.0",
"v4.20.0-beta.6",
"v4.20.0-beta.5",
"v4.20.0-beta.4",
"v4.20.0-beta.3",
"v4.19.1",
"v4.20.0-beta.2",
"v4.20.0-beta.1",
"v4.20.0-beta.0",
"v4.19.0",
"v4.19.0-beta.2",
"v4.19.0-beta.1",
"v4.19.0-beta.0",
"v4.18.7",
"v4.18.6",
"v4.18.5",
"v4.18.4",
"v4.18.1",
"v4.18.0",
"v4.18.0-beta.14",
"v4.18.0-beta.13",
"v4.18.0-beta.12",
"v4.18.0-beta.11",
"v4.18.0-beta.10",
"v4.18.0-beta.9",
"v4.18.0-beta.8",
"v4.18.0-beta.7",
"v4.18.0-beta.6",
"v4.18.0-beta.5",
"v4.18.0-beta.4",
"v4.18.0-beta.3",
"v4.18.0-beta.2",
"v4.18.0-beta.1",
"v4.18.0-beta.0",
"v4.17.0-beta.11",
"v4.17.0-beta.10",
"v4.17.0-beta.9",
"v4.17.0-beta.8",
"v4.17.0-beta.7",
"v4.17.0-beta.6",
"v4.17.0-beta.5",
"v4.17.0-beta.4",
"v4.17.0-beta.3",
"v4.17.0-beta.2",
"v4.17.0-beta.1",
"v4.17.0-beta.0",
"v4.16.0",
"v4.15.1",
"v4.15.0-beta.10",
"v4.15.0-beta.9",
"v4.15.0-beta.8",
"v4.15.0-beta.7",
"v4.15.0-beta.6",
"v4.15.0-beta.5",
"v4.15.0-beta.4",
"v4.15.0-beta.2",
"v4.15.0-beta.1",
"v4.15.0-beta.0",
"v4.14.0",
"v4.14.0-beta.4",
"v4.14.0-beta.3",
"v4.14.0-beta.2",
"v4.14.0-beta.0",
"v4.13.0-beta.5",
"v4.13.0-beta.4",
"v4.13.0-beta.3",
"v4.13.0-beta.2",
"v4.13.0-beta.0",
"v4.11.0-beta.2",
"v4.11.0-beta.1",
"v4.11.0-beta.0",
"v4.10.0",
"v4.10.0-beta.6",
"v4.9.1",
"v4.8.2",
"v4.2.3",
"v4.10.0-beta.5",
"v4.10.0-beta.4",
"v4.10.0-beta.3",
"v4.10.0-beta.2",
"v4.10.0-beta.1",
"v4.10.0-beta.0",
"v4.5.1",
"v4.9.0",
"v4.9.0-beta.0",
"v4.7.2",
"v4.6.5",
"v4.8.1",
"v4.8.0",
"v4.8.0-beta.2",
"v4.4.5",
"v4.8.0-beta.1",
"v4.8.0-beta.0",
"v4.7.1",
"v4.7.0",
"v4.6.4",
"v4.6.3",
"v4.6.1",
"v4.6.0",
"v4.6.0-beta.9",
"v4.6.0-beta.8",
"v4.6.0-beta.7",
"v4.6.0-beta.6",
"v4.6.0-beta.5",
"v4.6.0-beta.4",
"v4.6.0-beta.3",
"v4.2.2",
"v4.2.1",
"v4.2.0",
"v4.2.0-beta.10",
"v4.2.0-beta.9",
"v4.2.0-beta.8",
"v4.2.0-beta.7",
"v4.2.0-beta.6",
"v4.2.0-beta.5",
"v4.2.0-beta.4",
"v4.2.0-beta.3",
"v4.2.0-beta.2",
"v4.2.0-beta.1",
"v4.1.2",
"v4.2.0-2",
"v4.2.0-1",
"v4.2.0-0",
"v4.1.4-0",
"v4.1.3-0",
"v4.1.1",
"v4.1.0",
"v4.1.0-beta.15",
"v4.1.0-beta.14",
"v4.1.0-beta.13",
"v4.1.0-beta.12",
"v4.1.0-beta.11",
"v4.1.0-beta.10",
"v4.1.0-beta.9",
"v4.1.0-beta.8",
"v4.1.0-beta.7",
"v4.1.0-beta.6",
"v4.1.0-beta.5",
"v4.1.0-beta.4",
"v4.1.0-beta.3",
"v4.1.0-beta.2",
"v4.1.0-beta.1",
"v4.1.0-beta.0",
"v4.0.6-beta.1",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v4.0.0-beta.6",
"v4.0.0-beta.5",
"v4.0.0-beta.4",
"v4.0.0-beta.3",
"v4.0.0-beta.2",
"v4.0.0-beta.1",
"v4.0.0-beta.0",
"v4.0.0-alpha.8",
"v4.0.0-alpha.7",
"v4.0.0-alpha.6",
"v4.0.0-alpha.4",
"v4.0.0-alpha.3",
"v3.17.4",
"v4.0.0-alpha.2",
"v4.0.0-alpha.1",
"v4.0.0-alpha.0",
"v3.17.2",
"v3.16.0",
"v3.17.1",
"v3.15.0",
"v3.14.0",
"v3.13.0",
"v3.12.0",
"v3.11.2",
"v3.11.1",
"v3.11.0",
"v3.10.1",
"v3.9.0",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.3",
"v3.5.2",
"v3.5.0",
"v3.5.0-0",
"v3.4.2",
"v3.4.0",
"v3.3.6",
"v3.3.5",
"v3.3.4",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.30",
"v3.2.29",
"v3.2.28",
"v3.2.27",
"v3.2.26"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63462.json"
}
}
],
"modified": "2026-10-28T02:30:50.580402295Z",
"provider": "osv",
"references": [
"https://github.com/Unleash/unleash/releases/tag/v7.5.2",
"https://github.com/Unleash/unleash/releases/tag/v7.6.5",
"https://github.com/Unleash/unleash/releases/tag/v8.0.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63462.json",
"https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp",
"https://nvd.nist.gov/vuln/detail/CVE-2026-63462",
"https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf",
"https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1",
"https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"
],
"provider_metadata": {
"cwe_ids": [
"CWE-674"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63462.json"
}
},
"related_cves": [
{
"value": "CVE-2026-63462",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518910,
"published_at": "2026-08-21T18:12:32.807+00:00"
}