Get real-time updates on Telegram
CVE-2026-113799: slack-morphism-rust >= 1.0.0, < 2.28.0
CVE-2026-113799 affects slack-morphism. CVSS 3.1 base score 5.3 (MEDIUM, Vendor/CNA). Affected range: >= 1.0.0, <= 2.27.0. Fixed version: 2.28.0.
Affected technology
slack-morphism-rust · >= 1.0.0, < 2.28.0
abdolence
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as high.
- CWE
- CWE-532
- Product
- slack-morphism
- CCR priority
- 21.2 /100 (P4)
- CVSS 3.1
- 5.3 /10 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N · Vendor/CNA
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-22 02:21:33.599910+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-22 01:08:24.561609+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-113799.html