Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Parse Server can crash from malformed file reference

CVE-2026-109301 · published 23 days ago
Summary

Versions of Parse Server prior to 8.6.95 and early 9.x releases may stop working if they receive a file reference that lacks a URL. This can happen when users or automated scripts write data that triggers Cloud Code or LiveQuery features, especially if the database allows public writes. Update to the latest version of Parse Server or add validation to reject such file references to keep the service running.

What to do
  • Update parse to version 9.10.2.
Affected software
Ecosystem VendorProductAffected versions
– parse-community parse-server < 9.10.2-alpha.3
< 8.6.95
Bitnami – parse >= 9.0.0, < 9.10.2
Fix: upgrade to 9.10.2
Original advisory text
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-248Uncaught Exception
Timeline
Published12 Oct 2026
Updated4 Nov 2026
First seen12 Oct 2026
Sources
CVE-2026-109301 · NVD
CVE-2026-109301 · OSV
GHSA-gpr6-gr9g-pfw6 · GHSA
CVE-2026-109301 · MITRE
BIT-parse-2026-109301 · OSV
Track software like this
Free during beta