CVE-2026-32944 | parse-community parse-server up to 8.6.44/9.6.0-alpha.20 recursion (GHSA-9xp9-j92r-p88v)

VDB-351616 · CVE-2026-32944 · GHSA-9XP9-J92R-P88V PARSE-COMMUNITY PARSE-SERVER UP TO 8.6.44/9.6.0-ALPHA.20 RECURSION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.1 $0-$5k 0.92+ Summaryinfo A vulnerability was found in parse-community parse-server up to 8.6.44/9.6.0-alpha.20. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to recursion. This vulnerability is handled as CVE-2026-32944. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component. Detailsinfo A vulnerability has been found in parse-community parse-server up to 8.6.44/9.6.0-alpha.20 and classified as problematic. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect availability. CVE summarizes: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-32944 since 03/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499. Upgrading to version 8.6.45 or 9.6.0-alpha.21 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Vendor parse-community Name parse-server Version 8.6.0 8.6.1 8.6.2 8.6.3 8.6.4 8.6.5 8.6.6 8.6.7 8.6.8 8.6.9 8.6.10 8.6.11 8.6.12 8.6.13 8.6.14 8.6.15 8.6.16 8.6.17 8.6.18 8.6.19 8.6.20 8.6.21 8.6.22 8.6.23 8.6.24 8.6.25 8.6.26 8.6.27 8.6.28 8.6.29 8.6.30 8.6.31 8.6.32 8.6.33 8.6.34 8.6.35 8.6.36 8.6.37 8.6.38 8.6.39 8.6.40 8.6.41 8.6.42 8.6.43 8.6.44 9.6.0-alpha.0 9.6.0-alpha.1 9.6.0-alpha.2 9.6.0-alpha.3 9.6.0-alpha.4 9.6.0-alpha.5 9.6.0-alpha.6 9.6.0-alpha.7 9.6.0-alpha.8 9.6.0-alpha.9 9.6.0-alpha.10 9.6.0-alpha.11 9.6.0-alpha.12 9.6.0-alpha.13 9.6.0-alpha.14 9.6.0-alpha.15 9.6.0-alpha.16 9.6.0-alpha.17 9.6.0-alpha.18 9.6.0-alpha.19 9.6.0-alpha.20 Website Product: https://github.com/parse-community/parse-server/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA CVSS-B Score: 🔒 CNA CVSS-BT Score: 🔒 CNA Vector: 🔒 CVSSv3info VulDB Meta Base Score: 5.3 VulDB Meta Temp Score: 5.1 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Recursion CWE: CWE-674 / CWE-404 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: parse-server 8.6.45/9.6.0-alpha.21 Patch: github.com Timelineinfo 03/17/2026 CVE reserved 03/18/2026 +1 days Advisory disclosed 03/18/2026 +0 days VulDB entry created 03/18/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-9xp9-j92r-p88v Status: Confirmed CVE: CVE-2026-32944 (🔒) GCVE (CVE): GCVE-0-2026-32944 GCVE (VulDB): GCVE-100-351616 Entryinfo Created: 03/18/2026 23:48 Changes: 03/18/2026 23:48 (67) Complete: 🔍 Cache ID: 99:624:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸