CVE-2026-73219: CVAT: Denial of service with regards to automatic annotation
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CVATto a version that resolves this vulnerability.Fixed in 2.72.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73219?
CVE-2026-73219 has a risk rating of 26, indicating a significant potential for denial of service.
How do I fix CVE-2026-73219?
To fix CVE-2026-73219, upgrade to a version of CVAT that is higher than 2.72.0.
What type of vulnerability is CVE-2026-73219?
CVE-2026-73219 is classified as a denial of service vulnerability.
Who is affected by CVE-2026-73219?
Users with write access to a CVAT job between versions 2.17.0 and 2.72.0 are affected by CVE-2026-73219.
What is the impact of CVE-2026-73219?
The impact of CVE-2026-73219 is that it allows users to potentially disrupt service through inconsistent task and job IDs when submitting annotations.