CVE-2026-47138

🗓️ 12 Jun 2026 18:22:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 20 Views

Unauthenticated denial of service in Parse Server caused by client version header backtracking; patched in 8.6.77 and 9.9.1-alpha.1.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-47138	12 Jun 202621:20	–	circl
Cvelist	CVE-2026-47138 Parse Server: Pre-authentication denial of service via client version header regex backtracking	12 Jun 202618:22	–	cvelist
EUVD	EUVD-2026-36535	12 Jun 202618:22	–	euvd
Github Security Blog	Parse Server: Pre-authentication denial of service via client version header regex backtracking	23 May 202600:11	–	github
NVD	CVE-2026-47138	12 Jun 202619:16	–	nvd
OSV	GHSA-38M6-82C8-4XFM Parse Server: Pre-authentication denial of service via client version header regex backtracking	23 May 202600:11	–	osv
Positive Technologies	PT-2026-42860	23 May 202600:00	–	ptsecurity
Snyk	Regular Expression Denial of Service (ReDoS)	16 May 202621:00	–	snyk
vulnersOsv	@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by CVE-2026-47138 via parse-server (>=9.6.0-alpha.37 <=9.9.0)	23 May 202600:11	–	vulnersosv
vulnersOsv	@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by CVE-2026-47138 via parse-server (>=9.6.0-alpha.37 <=9.9.0)	16 May 202621:00	–	vulnersosv

Vulners

Node

parse-community parse-serverRange<8.6.77

parse-community parse-serverRange9.0.0–9.9.1-alpha.1

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.77",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.9.1-alpha.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/pull/10463
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm
github	www.github.com/parse-community/parse-server/pull/10464

12 Jun 2026 19:16Current

5.2Medium risk

Vulners AI Score5.2

CVSS 48.7

EPSS0.00097

SSVC

CWE-1333