CVE-2026-19500: SureForms contains an uncontrolled resource consumption vulnerability
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brainstorm Force SureForms Entries componentto a version that resolves this vulnerability.Fixed in 2.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
SureForms versions earlier than 2.1.3 are affected. The issue is in the Entries component, so administrators using that interface can be prevented from accessing it when resource exhaustion occurs.
What does an attacker need to exploit this issue?
An attacker needs the ability to submit crafted form content remotely. The provided information does not state that authentication or administrative access is required.
What operational impact should responders expect?
Successful exploitation can exhaust server resources, cause HTTP 500 errors, and prevent administrators from accessing the Entries interface.