{"id":"EUVD-2026-36307","enisaUuid":"51521cff-a27d-3328-b03b-61ec9045e950","description":"Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.","datePublished":"Jun 11, 2026, 7:11:49 PM","dateUpdated":"Oct 8, 2026, 3:23:10 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://github.com/steipete/summarize/pull/237\nhttps://github.com/steipete/summarize/commit/14de194c24c5e0fba4bdb4a6f7766eb6ea3ed750\nhttps://www.vulncheck.com/advisories/summarize-disk-exhaustion-via-uncapped-media-download\n","aliases":"CVE-2026-53781\nGHSA-q9xm-f36c-xm3q\n","assigner":"VulnCheck","epss":0.32,"enisaIdProduct":[{"id":"6aa050f1-70c0-3098-9cd5-d46640c35a26","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.17.0"}],"enisaIdVendor":[{"id":"a5ecb1c9-dc3f-35fa-9ce3-ed581a1fdb3c","vendor":{"name":"steipete"}}],"enisaIdVulnerability":[{"id":"5c13035a-ca4e-356e-b13a-49953c702dc1","vulnerability":{"id":"GHSA-q9xm-f36c-xm3q","description":"@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses","datePublished":"Jun 11, 2026, 9:31:56 PM","dateUpdated":"Jul 27, 2026, 4:06:56 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-53781\nhttps://github.com/steipete/summarize/pull/237\nhttps://github.com/steipete/summarize/commit/14de194c24c5e0fba4bdb4a6f7766eb6ea3ed750\nhttps://github.com/steipete/summarize\nhttps://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://www.vulncheck.com/advisories/summarize-disk-exhaustion-via-uncapped-media-download\n","enisa_id":"EUVD-2026-36307\n","aliases":"CVE-2026-53781\nGHSA-q9xm-f36c-xm3q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ae8d889d-5c35-3827-832a-702fa02c5557","vulnerability":{"id":"CVE-2026-53781","description":"Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.","datePublished":"Jun 11, 2026, 7:11:49 PM","dateUpdated":"Oct 8, 2026, 3:23:10 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://github.com/steipete/summarize/pull/237\nhttps://github.com/steipete/summarize/commit/14de194c24c5e0fba4bdb4a6f7766eb6ea3ed750\nhttps://www.vulncheck.com/advisories/summarize-disk-exhaustion-via-uncapped-media-download\n","enisa_id":"EUVD-2026-36307\n","assigner":"VulnCheck","epss":0.32,"dataProcessed":"Nov 5, 2026, 7:16:59 AM","vulnerabilityProduct":[{"id":"7ec325cf-db27-3bf5-8b4e-8a4c296d1b88","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.17.0"}],"vulnerabilityVendor":[{"id":"d7807879-b103-3aa2-b34d-246dbbdd588b","vendor":{"name":"steipete"}}]}}],"enisaIdAdvisory":[]}