Cpe:2.3:a:blueprintue:blueprintue_self-Hosted_edition:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ablueprintueblueprintue_self-hosted_edition/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:55:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBlueprintUE Self-Hosted Edition: Resource exhaustion vulnerability (CVE-2026-126659)https://feed.craftedsignal.io/briefs/2026-11-blueprintue-resource-exhaustion-cve-2026-126659/Wed, 11 Nov 2026 13:55:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-blueprintue-resource-exhaustion-cve-2026-126659/An unauthenticated resource exhaustion vulnerability in BlueprintUE Self-Hosted Edition allows attackers to fill server storage and cause a denial-of-service condition via large blueprint creation requests.BlueprintUE Self-Hosted Edition versions prior to 4.3.5 are vulnerable to a resource exhaustion attack (CVE-2026-126659). The vulnerability exists in the HomeController::doProcessCreateBlueprint() function, where unauthenticated users can trigger the creation of anonymous blueprints. By submitting large requests with the expiration parameter set to 'never', attackers can bypass automated purge mechanisms, leading to rapid disk space consumption and a denial-of-service state for the application.

Impact

Successful exploitation results in a denial-of-service condition due to disk space exhaustion on the host server.

Recommendation

  • Patch the application immediately by upgrading BlueprintUE Self-Hosted Edition to version 4.3.5 or later.
  • Audit existing blueprint storage directories for an abnormally high count of files with indefinite expiration settings.
]]>lowadvisory