CVE-2026-75897

HighCVSS 7.5/10Last modified Aug 20, 2026

Description

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
OpenSearch	OpenSearch Dashboards	>= 1.3, <= 3.7.0
AWS	Amazon OpenSearch Service	>= 1.3, <= 3.5

References

Timeline

Published: Aug 18, 2026
Last modified: Aug 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-758988.5RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.CVE-2026-758997.5fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second CVE-2026-75907.3A vulnerability was identified in eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an CVE-2026-759006.1An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length agains CVE-2026-759038.1The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to CVE-2026-759043.3libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound CVE-2026-759054.3The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to CVE-2026-759077.5The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 CVE-2026-759084.3The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the pl CVE-2026-75916.3A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/CVE-2026-759106.5Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could al CVE-2026-759117.8CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attac