CVE-2026-86019: CWE-400: Uncontrolled Resource Consumption in Part-DB Part-DB-server
Description
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
CVSS v4.0
Score 5.3medium
Affected software
Part-DB
Part-DB-server
pkg:github/part-db/Part-DB-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86019 describes an uncontrolled resource consumption vulnerability (CWE-400) in Part-DB-server, an open source inventory management system. The vulnerability arises because the API upload path for attachments using base64-encoded data does not enforce the configured maximum attachment file size, unlike the browser-based upload path. Authenticated users with permission to create attachments can exploit this to upload oversized files, potentially leading to disk space exhaustion and denial of service. The vulnerability is patched in Part-DB-server version 2.13.2.
Potential Impact
An authenticated user with API access and attachment creation permissions can upload files exceeding the configured size limit, potentially exhausting disk space on the server. This can cause denial of service by preventing normal operation of the application due to resource exhaustion.
Mitigation Recommendations
Upgrade Part-DB-server to version 2.13.2 or later, where this vulnerability has been patched. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-04T19:23:40.691Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adae3064d27ba8daaca106e
Added to database: 10/23/2026, 04:31:02 UTC
Last enriched: 10/23/2026, 04:45:26 UTC
Last updated: 10/23/2026, 04:45:52 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.