CVE-2026-32641 Details

A denial-of-service vulnerability has been identified in the Parseable log analytics platform, affecting versions through 2.5.14. The issue arises in the HTTP middleware, where user-controlled input from the 'x-amz-firehose-common-attributes' header is parsed using multiple 'unwrap()' calls without proper validation. This flaw allows remote, unauthenticated attackers to send non-UTF-8 header data, malformed JSON, or invalid derived header values, triggering a Rust panic that disrupts request handling. The resulting server crash can lead to service interruptions or container restart loops in orchestrated environments. Notably, this vulnerability exists before authentication checks, enabling exploitation without credentials.

Users can upgrade to Parseable version 3.0.0 or later, where this vulnerability has been fixed. In the patched version, the middleware no longer uses 'unwrap()' on user-controlled input without validation, preventing the panic and associated denial-of-service condition.