{"id":"EUVD-2026-93498","enisaUuid":"8fa604c1-703f-335a-98fc-4e08d194a8be","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:17:30 PM","dateUpdated":"Oct 6, 2026, 5:30:01 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7\nhttps://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105854\nGHSA-2g7p-5934-q4w7\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"8049c81d-8793-3614-93a0-3a132e4e4a96","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"b622b18a-a57a-37f3-86d6-8b485662f615","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"}],"enisaIdVendor":[{"id":"de8fdc79-0198-393d-bfe8-499c4bbd8f9d","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"24cfd6c5-8e36-343c-976e-6ba502b7f8ef","vulnerability":{"id":"CVE-2026-105854","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:17:30 PM","dateUpdated":"Oct 6, 2026, 5:30:01 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7\nhttps://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93498\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"4608b285-f7ba-3254-a5ca-50eaecf20b06","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"fe19df63-f205-3f7f-8369-2710d833e1ec","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"dc16ca80-1017-3451-8b64-1247dbeb4902","vendor":{"name":"payloadcms"}}]}},{"id":"3825c9af-2e09-320d-9316-841f47d3688b","vulnerability":{"id":"GHSA-2g7p-5934-q4w7","description":"Payload: ReDoS in Multipart Content-Type Validation","datePublished":"Oct 6, 2026, 4:18:27 PM","dateUpdated":"Oct 6, 2026, 4:18:27 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7\nhttps://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93498\n","aliases":"CVE-2026-105854\nGHSA-2g7p-5934-q4w7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}