CVE-2026-126938
Last modified
CVE-2026-126938 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| diced | zipline | < 4.6.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-126938?
How severe is CVE-2026-126938?
How do I fix CVE-2026-126938?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126932Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerab…4.3
- CVE-2026-126933Zipline 4.0.0 before 4.8.0 contains an upload filter bypass …4.3
- CVE-2026-126934Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vuln…6.5
- CVE-2026-126935Zipline before 4.8.0 contains a race condition vulnerability…3.7
- CVE-2026-126936Zipline before 4.7.0 contains a race condition vulnerability…5.9
- CVE-2026-126937Zipline before 4.6.5 contains a TOCTOU race condition in the…8.1
- CVE-2026-126939Zipline before 4.6.4 contains an information disclosure vuln…5.3
- CVE-2026-12694Missing Authorization vulnerability in Vimesoft Inc. Enterpr…9.1
- CVE-2026-126940Zipline before 4.6.4 contains a rate limit bypass vulnerabil…6.5
- CVE-2026-126941Zipline through 4.6.2 contains an authorization bypass vulne…6.8
- CVE-2026-126942Zipline before 4.6.2 contains a missing authorization vulner…5.4
- CVE-2026-126943Zipline from 4.2.0 before 4.6.2 contains an information disc…4.9
Are you affected by CVE-2026-126938?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST