CVE-2026-53781

MediumCVSS 4.3/10Last modified Oct 8, 2026

Description

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-537827.4Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct CVE-2026-537838.1rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper thatCVE-2026-537847.1rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when CVE-2026-537857.1rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination diCVE-2026-537866.5rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictionCVE-2026-537879.8Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unautCVE-2026-537886.5rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers toCVE-2026-537898.1rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operationCVE-2026-53793.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. ThCVE-2026-537908.1rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by suCVE-2026-537919.1rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based acceCVE-2026-537926.5rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to
CVE-2026-53781: Medium severity, CVSS 4.3 | Vulnix