Bug 2538368 (CVE-2026-93749)
| Summary: | CVE-2026-93749 source-map-js: source-map-js: Denial of Service via malformed indexed source maps | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, abrianik, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bparees, brasmith, bstansbe, cmyers, cochase, csuconic, dbruscin, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, dschmidt, dymurray, eborisov, ehelms, ehugonne, ewittman, flucifre, fmariani, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, gtanzill, gtully, hasun, ibolton, istudens, ivassile, iweiss, janstey, jbalunas, jbuscemi, jchui, jdelft, jfula, jhe, jhorak, jlanda, jlledo, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jraez, jsherman, jupierce, juwatts, jwong, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, lgarciaa, mbenjamin, mbiarnes, mcarlett, mdellweg, mhackett, mhulan, mosmerov, mposolda, msvehla, mvyas, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, parichar, pberan, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, prwatson, psrna, ptisnovs, rbobbitt, rchan, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rmartinc, rstancel, rstepani, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, ssilvert, stcannon, sthorger, suppawar, syedriko, tasato, tbish, tcunning, thjenkin, tlavocat, tmalecek, tsedmik, tsze, vdosoudi, vereddy, veshanka, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-22 18:18:34 UTC
|