CVE-2026-50787 Details
Description
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.
A denial-of-service vulnerability has been identified in e-SIC Livre (esiclivre) versions through 0.2.2. The issue resides in the CAPTCHA generation component, specifically within restrito/inc/captcha.php. The vulnerability allows remote attackers to cause excessive memory and CPU consumption by exploiting user-supplied parameters used to generate CAPTCHA images. This uncontrolled resource consumption can lead to application timeouts, HTTP 5xx responses, and temporary service unavailability.
Users are advised to apply local validation and resource limits on the CAPTCHA generation parameters. This includes converting parameters to integers, enforcing minimum and maximum values, rejecting out-of-range values, using fixed server-side CAPTCHA dimensions where possible, limiting the number of rendered characters, and implementing rate limiting on the CAPTCHA endpoint. Additionally, generated image resources should be cleared from memory after use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/brynax/CVE-2026-50787 | [email protected] | AdvisoryRemedy |
| https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| e-SIC Livre | <v0.2.2, <= 0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |