CVE-2024-23826

Name: CVE-2024-23826
Creator: NVD / NIST
Published: 2024-01-29T16:15:09.64+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.7/10EPSS 0.45%

Last modified Jun 17, 2026

CVE-2024-23826 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. EPSS estimates a 0.45% chance of exploitation in the next 30 days.

Description

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release.

Metrics

CVSS 3.1

5.7/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

EPSS Probability

0.45%

35.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Se.Math.Spbu	Spbu Se Site	< 2024.01.29

References

https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57dPatch
https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwmExploit, Third Party Advisory
https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57dPatch
https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwmExploit, Third Party Advisory

Timeline

Published: Jan 29, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-23826?

How severe is CVE-2024-23826?

CVE-2024-23826 has a CVSS score of 5.7/10 (MEDIUM severity). The EPSS model estimates a 0.45% probability of exploitation in the next 30 days.

How do I fix CVE-2024-23826?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-23826?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST