CVE-2026-32641

HIGH 7.5

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.

CWE	CWE-248 CWE-703
Vendor	parseablehq
Product	parseable
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for parseablehq parseable

Be the first to know when new high vulnerabilities affecting parseablehq parseable are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

parseablehq / parseable

< 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx github.com: https://github.com/parseablehq/parseable/pull/1581 github.com: https://github.com/parseablehq/parseable/commit/6c583081a4161476128f330b9bb71ed7305eecde github.com: https://github.com/parseablehq/parseable/releases/tag/v3.0.0