{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/blueprintue-self-hosted-edition--4.3.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:blueprintue:blueprintue_self-hosted_edition:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126659"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BlueprintUE Self-Hosted Edition (\u003c 4.3.5)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["BlueprintUE"],"content_html":"\u003cp\u003eBlueprintUE Self-Hosted Edition versions prior to 4.3.5 are vulnerable to a resource exhaustion attack (CVE-2026-126659). The vulnerability exists in the HomeController::doProcessCreateBlueprint() function, where unauthenticated users can trigger the creation of anonymous blueprints. By submitting large requests with the expiration parameter set to 'never', attackers can bypass automated purge mechanisms, leading to rapid disk space consumption and a denial-of-service state for the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service condition due to disk space exhaustion on the host server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the application immediately by upgrading BlueprintUE Self-Hosted Edition to version 4.3.5 or later.\u003c/li\u003e\n\u003cli\u003eAudit existing blueprint storage directories for an abnormally high count of files with indefinite expiration settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:55:35Z","date_published":"2026-11-11T13:55:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-blueprintue-resource-exhaustion-cve-2026-126659/","summary":"An unauthenticated resource exhaustion vulnerability in BlueprintUE Self-Hosted Edition allows attackers to fill server storage and cause a denial-of-service condition via large blueprint creation requests.","title":"BlueprintUE Self-Hosted Edition: Resource exhaustion vulnerability (CVE-2026-126659)","url":"https://feed.craftedsignal.io/briefs/2026-11-blueprintue-resource-exhaustion-cve-2026-126659/"}],"language":"en","title":"CraftedSignal Threat Feed - BlueprintUE Self-Hosted Edition (\u003c 4.3.5)","version":"https://jsonfeed.org/version/1.1"}