CVE-2026-86018: CWE-400: Uncontrolled Resource Consumption in Part-DB Part-DB-server
Description
Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
CVSS v4.0
Score 5.3medium
Affected software
Part-DB
Part-DB-server
pkg:github/part-db/Part-DB-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86018 is an uncontrolled resource consumption vulnerability (CWE-400) in Part-DB-server, an open source inventory management system. Before version 2.13.2, authenticated users can bypass the configured MAX_ATTACHMENT_FILE_SIZE limit when using the server-side 'Download external file' attachment feature. The server downloads and streams remote files directly to disk without enforcing the size limit, allowing storage of files larger than intended. This can exhaust disk space and cause denial of service. The vulnerability is patched in version 2.13.2.
Potential Impact
An authenticated user with permission to create or edit attachments can cause the server to store files exceeding the configured maximum size, potentially exhausting disk space and leading to denial of service conditions on the Part-DB-server.
Mitigation Recommendations
Upgrade Part-DB-server to version 2.13.2 or later, where this vulnerability has been patched. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-04T19:23:40.691Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adae3064d27ba8daaca106d
Added to database: 10/23/2026, 04:31:02 UTC
Last enriched: 10/23/2026, 04:45:29 UTC
Last updated: 10/23/2026, 04:45:52 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.