CVE-2026-42886 Details
Description
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP file entirely into memory using zip.entryData(), with no limit on the decompressed size. The upload middleware also has no file size limit. An admin user can upload a crafted ZIP containing a highly compressed details entry that, when decompressed, consumes hundreds of megabytes or gigabytes of memory, crashing the server process via out-of-memory. This vulnerability is fixed in 2.32.2.
A denial-of-service vulnerability has been identified in Audiobookshelf versions prior to 2.32.2. The issue arises in the POST /api/backups/upload endpoint, where the details entry of an uploaded .audiobookshelf ZIP file is decompressed entirely into memory without any size limit. This flaw allows an admin user to upload a ZIP file containing a highly compressed details entry that, when expanded, consumes excessive amounts of memory, leading to a server crash. The upload middleware also lacks a file size limit, exacerbating the problem.
Users can update to Audiobookshelf version 2.32.2 or later, where this vulnerability has been fixed. Additionally, for those managing their own Audiobookshelf instances, it is recommended to configure a file size limit in the upload middleware to prevent the upload of excessively large files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Audiobookshelf | 2.32.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |