P5 Verified
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
CVE-2026-17508. EPSS 0.00436 (percentile 0.35644), scored 2026-10-03. Fixed version: eacda831fbe15b272933e40841d8b0827b556fae. Fixed version: 20ed9e203caec91d25cd386ceb6d364e9b068f67. Fixed version: 442393bf187c914b1e66fbed4fab532a1fe06c6a. Fixed version: 480d878aa6f7dc8b20403064f304bbe0decbbb1a. Fixed version: 766a31026ac24ed3c6cad8662058ba450c338da1. Fixed version: 882fdab53f6c4c150a5d6a4e6ef1fc05d382385a. Fixed version: e72bc0681ff4227fced912ef7394daf7b7d57bb3. Fixed version: 43d27611d3b82e54050d1def60b516f8295e485b.
- CVE / CWE
- CVE-2026-17508 /
- Vendor / product
- Unavailable / Unavailable
- Severity
- 0.1
- CVSS
- Unavailable · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber · osv
- EPSS
- 0.00436 · percentile 0.35644 · 2026-10-03
- KEV
- no · added unavailable · due unavailable · ransomware use unavailable
- Exploit signals
- Signal evidence
Affected products
- Product unavailable · Fixed version: eacda831fbe15b272933e40841d8b0827b556fae
- Product unavailable · Fixed version: 20ed9e203caec91d25cd386ceb6d364e9b068f67
- Product unavailable · Fixed version: 442393bf187c914b1e66fbed4fab532a1fe06c6a
- Product unavailable · Fixed version: 480d878aa6f7dc8b20403064f304bbe0decbbb1a
- Product unavailable · Fixed version: 766a31026ac24ed3c6cad8662058ba450c338da1
- Product unavailable · Fixed version: 882fdab53f6c4c150a5d6a4e6ef1fc05d382385a
- Product unavailable · Fixed version: e72bc0681ff4227fced912ef7394daf7b7d57bb3
- Product unavailable · Fixed version: 43d27611d3b82e54050d1def60b516f8295e485b
Provenance
- OSV.dev · Source record · observed 2026-10-04 08:10:59.885464+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-17508.html