CVE-2026-32641

Summary

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.

Affected Software

VendorProductVersion RangeStatus
parseablehqparseable< 3.0.0affected

Weaknesses

  • CWE-248: CWE-248: Uncaught Exception
  • CWE-703: CWE-703: Improper Check or Handling of Exceptional Conditions

References