Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-45822

Medium

decode-uri-component through 0.4.1 is vulnerable to denial of service.

Published Jun 30, 2026 · Updated Sep 10, 2026 · Also known as EUVD-2026-40267, GHSA-vcc3-ghjq-m6fr, UBUNTU-CVE-2026-45822

Key Facts

Routine patching
  • CVE-2026-45822 is a medium-severity vulnerability (CVSS 6.6 v4) affecting commercial-gitlab-rails-ee-19.1 (chainguard), commercial-gitlab-rails-ee-19.2 (chainguard), commercial-gitlab-rails-ee-19.3 (chainguard) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 0.5% probability of exploitation in the next 30 days.
  • Fixed versions are available, including @seal-security/decode-uri-component 0.2.0-sp999, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1.
  • Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v4

6.6

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

EPSS (30-day exploit likelihood)

0.5%

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2026-45822 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Affected Products

63 affected entries in total
ProductAffected versionsFixed in
commercial-gitlab-rails-ee-19.1chainguardSee advisory19.1.7-r3
commercial-gitlab-rails-ee-19.2chainguardSee advisory19.2.7-r1
commercial-gitlab-rails-ee-19.3chainguardSee advisory19.3.3-r1
commercial-gitlab-rails-ee-fips-19.2chainguardSee advisory19.2.7-r1
commercial-gitlab-rails-ee-fips-19.3chainguardSee advisory19.3.3-r1
20 more affected products in the full CVE brief

Patched Releases

@seal-security/decode-uri-component

0.2.0-sp999

commercial-gitlab-rails-ee-19.1

19.1.7-r3

commercial-gitlab-rails-ee-19.2

19.2.7-r1

commercial-gitlab-rails-ee-19.3

19.3.3-r1

commercial-gitlab-rails-ee-fips-19.2

19.2.7-r1

commercial-gitlab-rails-ee-fips-19.3

19.3.3-r1

decode-uri-component

0.2.0-sp999, 0.5.0

dotnet8

0-main-8.0.128-1.1.hum1

dotstatsuite-supercore

3.1.0_git20260901-r1

ghost-cli

1.32.0-r0

gitlab-rails-ce-19.1

19.1.7-r6

gitlab-rails-ce-19.2

19.2.5-r2

gitlab-rails-ce-19.3

19.3.1-r6

gitlab-rails-ce-fips-18.11

18.11.11-r2

gitlab-rails-ce-fips-18.7

18.7.7-r7

gitlab-rails-ce-fips-19.1

19.1.7-r7

gitlab-rails-ce-fips-19.3

19.3.1-r3

kibana-8.19

8.19.21-r1

kibana-9.4

9.4.6-r1

kibana-9.5

9.5.2-r3

kubeflow-pipelines

2.17.2-r4

logto

1.44.0-r0

nextcloud-server-32

32.0.14-r4

nextcloud-server-33

33.0.8-r3

nextcloud-server-34

34.0.3-r2

Timeline

  1. Publicly disclosed

    Jun 30, 2026

  2. Last updated

    Sep 10, 2026

Weakness Type

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-405 Asymmetric Resource Consumption (Amplification)
  • CWE-407 Inefficient Algorithmic Complexity
  • CWE-1050 Excessive Platform Resource Consumption within a Loop
  • CWE-1176 Inefficient CPU Computation

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-45822 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo