CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server
Remote unauthenticated attackers can crash the AirSane scanner server by sending HTTP requests with excessively large Content-Length headers, causing memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54135?
CVE-2026-54135 is a high-severity denial of service vulnerability in SimulPiscator AirSane, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.
Which versions are affected by CVE-2026-54135?
How do I fix CVE-2026-54135?
No fix has been published for CVE-2026-54135 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54135 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54135 exists.
Sources
Also known as GHSA-p5hv-3m79-452q.