CVE-2026-32641: Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parseableto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Parseable versions prior to 3.0.0 are affected where the HTTP middleware processes the x-amz-firehose-common-attributes header. Because parsing occurs before authentication, the affected request path is exposed to unauthenticated remote clients.
What does an attacker need to send to trigger the failure?
An attacker can send non-UTF-8 header data, malformed JSON, or invalid values derived from the x-amz-firehose-common-attributes header. No credentials or user interaction are required.
What is the operational impact of exploitation?
The malformed header can trigger a Rust panic during request handling. Repeated requests can deny service or cause container restart loops.
How can this issue be remediated?
Upgrade Parseable to version 3.0.0, which fixes the issue.