Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54135— AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

Quick assessment

Affected
SimulPiscator AirSane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AirSane 是一个 SANE 前端程序，同时也是一个支持 Apple AirScan 协议的扫描仪服务器。在 0.4.12 之前的版本中，AirSane 的自定义 HTTP 服务器实现存在一个漏洞，使得远程未认证的攻击者能够通过内存耗尽（OOM）触发拒绝服务（DoS）。 具体而言，在 中， 函数读取 请求头，并直接将该值传递给 ，但缺少对上限值的校验和安全的解析逻辑。攻击者可以发送一个带有异常大 值的 HTTP POST 请求，迫使守护进程尝试分配数 GB 的内存，导致 异常并立即使 AirSane 进程崩溃。

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
SimulPiscator AirSane < 0.4.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54135

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server
Source: CVE Program / CVE List V5
Vulnerability Description
AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
SimulPiscator AirSane < 0.4.12 -

II. Public POCs for CVE-2026-54135

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54135

请登录查看更多情报信息。

Other References for CVE-2026-54135 (3)

IV. Related Vulnerabilities

Same weakness: CWE-400

V. Comments for CVE-2026-54135

No comments yet

Leave a comment