{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54135 exists.","fix":"No fix has been published for CVE-2026-54135 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-54135 is a high-severity denial of service vulnerability in SimulPiscator AirSane, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54135 and fix it if it is affected.\n\nWhat it is: CVE-2026-54135 is a high-severity denial of service vulnerability in SimulPiscator AirSane, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54135 exists.\n\nAffected product: SimulPiscator AirSane. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54135/ (Markdown: https://insights.sbomify.com/CVE-2026-54135/index.md)","id":"CVE-2026-54135","markdown":"https://insights.sbomify.com/CVE-2026-54135/index.md","name":"CVE-2026-54135","record":{"aliases":["GHSA-p5hv-3m79-452q"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"AirSane scanner server","requires_auth":"none","summary":"Remote unauthenticated attackers can crash the AirSane scanner server by sending HTTP requests with excessively large Content-Length headers, causing memory exhaustion.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server","id":"CVE-2026-54135","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search","id":"CVE-2026-54136"},"packages":[],"prev":{"headline":"OctoPrint: File exfiltration possible via query parameters on upload endpoints","id":"CVE-2026-54134"},"products":["AirSane"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["SimulPiscator"]},"summary":"Remote unauthenticated attackers can crash the AirSane scanner server by sending HTTP requests with excessively large Content-Length headers, causing memory exhaustion.","url":"https://insights.sbomify.com/CVE-2026-54135/"}