GitHub Advisoryadvisory · Go

GHSA-v553-g2w6-295p Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

MEDIUM Published 2026-06-09 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-33582
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-434
Reviewed
2026-07-31

Affected packages

• Go github.com/apache/incubator-answer: < 1.7.2-0.20260325113131-cfc3e54f30cc → fixed in 1.7.2-0.20260325113131-cfc3e54f30cc

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-33582 Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References