CVE-2026-55241: CWE-400: Uncontrolled Resource Consumption in bluewave-labs Checkmate
Description
CVE-2026-55241 is a high-severity vulnerability in bluewave-labs Checkmate prior to version 3.9.1. It involves uncontrolled resource consumption via the public POST /api/v1/auth/register endpoint, which processes multipart profile image uploads without limits on file size, count, or MIME type. An unauthenticated attacker can submit concurrent oversized files that are buffered in memory before registration validation, leading to memory exhaustion and potential backend crashes or destabilization. This issue is fixed in version 3.9.1.
CVSS v3.1
Score 7.5high
Affected software
bluewave-labs
Checkmate
pkg:github/bluewave-labs/CheckmateRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Checkmate versions before 3.9.1 have an uncontrolled resource consumption vulnerability (CWE-400) in the registration API endpoint. The server uses in-memory Multer parsing for multipart profile image uploads without enforcing file size, count, or MIME type restrictions. Because validation occurs after buffering, an unauthenticated attacker can send multiple large files concurrently, exhausting server memory and causing crashes or instability. The vulnerability is addressed by applying the fix introduced in version 3.9.1.
Potential Impact
An unauthenticated attacker can cause denial of service by exhausting server memory resources through oversized multipart file uploads during registration. This leads to backend crashes or destabilization, impacting availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade Checkmate to version 3.9.1 or later, where the issue is fixed by adding file size, count, and MIME type limits before buffering uploads. No other mitigations are specified. Patch status is confirmed fixed in 3.9.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T16:44:00.624Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8893f9acd9273b4983fd4c
Added to database: 08/21/2026, 18:07:53 UTC
Last enriched: 09/10/2026, 17:36:00 UTC
Last updated: 10/05/2026, 18:48:20 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.