CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.1 are vulnerable due to inadequate validation of the note field length in the POST /account/accept/{acceptance} endpoint, enabling authenticated users to submit excessively large inputs. This can lead to denial of service by exhausting PHP worker CPU resources during markdown parsing. Organizations using affected versions should prioritize this vulnerability to prevent potential disruptions in service.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.
Related CVEs
Other vulnerabilities affecting the same vendor(s)