{"id":"CVE-2026-126659","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126659","summary":"BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous…","details":"BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service.","published":"2026-11-11T13:17:24.167","modified":"2026-11-11T13:17:24.167","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de","label":"blueprintue/blueprintue-self-hosted-edition@0709b39"},"references":[{"type":"WEB","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.4/app/controllers/www/HomeController.php#L151-L214"},{"type":"WEB","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de"},{"type":"WEB","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/268"},{"type":"WEB","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5"},{"type":"WEB","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T13:17:24.167"}}