CVE-2026-33508

🗓️ 24 Mar 2026 18:21:08Reported by MendType

mend🔗 www.mend.io👁 4 Views

Parse Server LiveQuery component allows DoS via deeply nested logical operators.

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2026-33508	24 Mar 202618:21	–	attackerkb
CNNVD	Parse Server 安全漏洞	24 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33508	24 Mar 202618:21	–	cve
Cvelist	CVE-2026-33508 Parse Server: LiveQuery subscription query depth bypass	24 Mar 202618:21	–	cvelist
EUVD	EUVD-2026-13917	26 Mar 202617:38	–	euvd
Github Security Blog	Parse Server LiveQuery subscription query depth bypass	20 Mar 202621:48	–	github
NVD	CVE-2026-33508	24 Mar 202619:16	–	nvd
OSV	BIT-PARSE-2026-33508 Parse Server: LiveQuery subscription query depth bypass	27 Mar 202607:14	–	osv
OSV	GHSA-6QH5-M6G3-XHQ6 Parse Server LiveQuery subscription query depth bypass	20 Mar 202621:48	–	osv
Positive Technologies	PT-2026-26791	20 Mar 202600:00	–	ptsecurity

Vulners

Node

OR

parseplatform parse-serverRange8.0.0–8.6.56

parseplatform parse-serverRange9.0.0–9.6.0-alpha.45

parseplatform parse-serverRange1.0.0–8.6.56

Source	Link
github	www.github.com/parse-community/parse-server/pull/10260
github	www.github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899
github	www.github.com/parse-community/parse-server/pull/10259
github	www.github.com/parse-community/parse-server
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33508
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33508.json
github	www.github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b

07 Oct 2026 22:47Current

CVSS 3.17.5

CVSS 48.2

EPSS0.0062

SSVC

Parse Server LiveQuery DoS nested logical operators CPU consumption