Denial of Service (DoS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Denial of Service DoS via the note field in the POST /account/accept/acceptance endpoint. An attacker can exhaust server resources by submitting excessively large input,...

CVE-2026-86734: Uncontrolled Resource Consumption

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...