{"metadata": {"vulnerability": "cve-2026-63462", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-07-16T21:37:45.768Z", "date_only": false, "value": "2026-07-16T21:37:45.768Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-63462", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-21T18:12:32.807Z", "date_only": false, "value": "2026-08-21T18:12:32.807Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-63462", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-21T18:12:32.807Z", "date_only": false, "value": "2026-08-21T18:12:32.807Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-63462", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-21T19:14:37Z", "date_only": false, "value": "2026-08-21T19:14:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R5PQ-6CHH-J3XP", "record": "GHSA-R5PQ-6CHH-J3XP", "field": "published"}, {"timestamp": "2026-08-21T19:14:37Z", "date_only": false, "value": "2026-08-21T19:14:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R5PQ-6CHH-J3XP", "record": "GHSA-R5PQ-6CHH-J3XP", "field": "modified"}, {"timestamp": "2026-08-21T19:17:31.927Z", "date_only": false, "value": "2026-08-21T19:17:31.927", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63462", "record": "FKIE_CVE-2026-63462", "field": "published"}, {"timestamp": "2026-08-21T20:00:52.833Z", "date_only": false, "value": "2026-08-21T20:00:52.833049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmkfxyxt722", "record": "CVE-2026-63462", "field": "creation_timestamp", "uuid": "94648b50-27b2-4e86-8e39-275885ab2158", "content": "\ud83d\udfe0 CVE-2026-63462 - High (7.5)\n\nUnleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shar...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63462/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmkfxyxt722"}, {"timestamp": "2026-08-22T12:31:57.212Z", "date_only": false, "value": "2026-08-22T12:31:57.212217Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/31e18879d387aa16512f599cadd2f7a1", "record": "CVE-2026-63462", "field": "creation_timestamp", "uuid": "c23fee24-4a4f-412f-ad95-0973d340837d", "content": "# CVE-2026-63462: CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63462\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Unleash server with a single ~10 KB nested JSON request, causing immediate and complete denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept available\n- **Impact**: Complete Denial of Service (DoS)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Unleash feature management server\n- **Unleash Server**: < 7.5.2 (Fixed in: `7.5.2`)\n- **Unleash Server**: >= 7.6.0, < 7.6.5 (Fixed in: `7.6.5`)\n- **Unleash Server**: >= 8.0.0, < 8.0.2 (Fixed in: `8.0.2`)\n\n## Mitigation\n\n- Upgrade Unleash platform to non-vulnerable release branches\n- Deploy Edge/WAF structural validation rules restricting JSON nesting depth\n- Configure process supervisors to automatically restart terminated Node.js processes\n\n**Remediation Steps:**\n1. Analyze package.json to identify instances of unleash-server falling within affected ranges (< 7.5.2, 7.6.0-7.6.4, 8.0.0-8.0.1)\n2. Update unleash-server dependency to v7.5.2, v7.6.5, or v8.0.2\n3. Rebuild and redeploy the containerized application\n4. Verify recovery mechanics by validating that systemd or Kubernetes restart policies are active\n\n## References\n\n- [GHSA Security Advisory](https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp)\n- [NVD CVE-2026-63462 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-63462)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-63462)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63462) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/31e18879d387aa16512f599cadd2f7a1"}, {"timestamp": "2026-08-25T17:32:06.100Z", "date_only": false, "value": "2026-08-25T17:32:06.100866Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-63462", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-25T17:32:06.100Z", "date_only": false, "value": "2026-08-25T17:32:06.100866Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63462", "record": "FKIE_CVE-2026-63462", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-25T17:33:23.689Z", "date_only": false, "value": "2026-08-25T17:33:23.689Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-63462", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-25T17:33:23.689Z", "date_only": false, "value": "2026-08-25T17:33:23.689Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-63462", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-09T21:20:38.860Z", "date_only": false, "value": "2026-09-09T21:20:38.860", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63462", "record": "FKIE_CVE-2026-63462", "field": "lastModified"}]}