CVE-2026-126659 json
BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Blueprints
published yesterday modified 21h ago also EUVD-2026-123403 , GHSA-q2vm-p36g-w596
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository blueprintue/blueprintue-self-hosted-edition. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service.
Patch / fix
- blueprintue blueprintue-self-hosted-edition 4.3.5
Is CVE-2026-126659 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- blueprintue blueprintue-self-hosted-edition
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de
patch
-
github.com
/blueprintue/blueprintue-self-hosted-edition/pull/268
patch, issue-tracking
-
github.com
/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596
vendor-advisory, advisory
-
github.com
/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5
release-notes
-
github.com
/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.4/app/controllers/www/HomeController.php#L151-L214
technical-description
-
vulncheck.com
/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints
third-party-advisory
Sources
- CVE List CVE-2026-126659
- NVD CVE-2026-126659
- Maintainer advisory GHSA-q2vm-p36g-w596
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of blueprintue/blueprintue-self-hosted-edition published their own advisory on GitHub. Reviewed sources take precedence over it.