CVE-2026-32641

HighCVSS 7.5

Published: 18/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.92%

59th percentile - higher than 59% of all known CVEs

Summary

Parseable prior to 3.0.0 uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling.

Risk Assessment

Repeated requests can cause denial of service or container restart loops, disrupting the analytics platform.

Recommendation

Upgrade Parseable to version 3.0.0 or later, which fixes this issue.

Other vulnerabilities in Parseable

CVE-2026-56783Medium
Parseable before version 2.9.2 exposes webhook tokens and basic-auth credentials in cleartext via notification-target API endpoints due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs by querying GET /api/v1/targets or related endpoints.

Original NVD description (English source)

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS