CVE-2026-27887

{"id": "CVE-2026-27887", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-26T02:16:20.360", "references": [{"url": "https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-774"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to allow connections to a database or web server which could return responses of unbounded size (e.g. tables with many rows or large content bodies), Spin may in some cases attempt to buffer the entire response before delivering it to the guest, which can lead to the host process running out of memory, panicking, and crashing. In addition, a malicious guest application could incrementally insert a large number of rows or values into a database and then retrieve them all in a single query, leading to large host allocations. Spin 3.6.1, SpinKube 0.6.2, and `containerd-shim-spin` 0.22.1 have been patched to address the issue. As a workaround, configure Spin to only allow access to trusted databases and HTTP servers which limit response sizes."}, {"lang": "es", "value": "Spin es una herramienta de desarrollo de c\u00f3digo abierto para construir y ejecutar aplicaciones sin servidor impulsadas por WebAssembly. Cuando Spin est\u00e1 configurado para permitir conexiones a una base de datos o servidor web que podr\u00eda devolver respuestas de tama\u00f1o ilimitado (p. ej., tablas con muchas filas o cuerpos de contenido grandes), Spin puede, en algunos casos, intentar almacenar en b\u00fafer la respuesta completa antes de entregarla al invitado, lo que puede llevar a que el proceso anfitri\u00f3n se quede sin memoria, entre en p\u00e1nico y se bloquee. Adem\u00e1s, una aplicaci\u00f3n invitada maliciosa podr\u00eda insertar incrementalmente un gran n\u00famero de filas o valores en una base de datos y luego recuperarlos todos en una sola consulta, lo que llevar\u00eda a grandes asignaciones del anfitri\u00f3n. Spin 3.6.1, SpinKube 0.6.2 y 'containerd-shim-spin' 0.22.1 han sido parcheados para abordar el problema. Como soluci\u00f3n alternativa, configure Spin para permitir el acceso solo a bases de datos y servidores HTTP de confianza que limiten los tama\u00f1os de respuesta."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}