CVE-2026-72582: fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72582?
CVE-2026-72582 has a severity rating of 7.5, indicating a high level of risk.
How do I fix CVE-2026-72582?
To address CVE-2026-72582, update fastschema to a version beyond 0.15.1 where the vulnerability has been patched.
What are the potential impacts of CVE-2026-72582?
CVE-2026-72582 can allow an unauthenticated remote attacker to crash the server process, resulting in a denial of service.
Is authentication required to exploit CVE-2026-72582?
No, CVE-2026-72582 can be exploited without authentication.
Which function contains the flaw in CVE-2026-72582?
The flaw in CVE-2026-72582 is located in the sendOTPEmail function within pkg/auth/local.go.