How severe is CVE-2026-3816?

CVE-2026-3816 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-3816 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-3816?

CVE-2026-3816 affects Owasp Defectdojo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-3816?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-3816 have an EU (EUVD) identifier?

Yes. CVE-2026-3816 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10324.

When was CVE-2026-3816 published?

CVE-2026-3816 was published on 2026-03-09 and last updated on 2026-06-17.

CVE-2026-3816

CVE-2026-3816 is a medium-severity vulnerability in Owasp Defectdojo with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1284.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.0
CVSS v4: 2.1
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-10324
Weakness: CWE-1284
Affected product: Owasp Defectdojo
Published: 2026-03-09
Last modified: 2026-06-17

Description

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

Frequently asked questions

What is CVE-2026-3816?: A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.
How severe is CVE-2026-3816?: CVE-2026-3816 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-3816 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-3816?: CVE-2026-3816 affects Owasp Defectdojo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-3816?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-3816 have an EU (EUVD) identifier?: Yes. CVE-2026-3816 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10324.
When was CVE-2026-3816 published?: CVE-2026-3816 was published on 2026-03-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:owasp:defectdojo:*:*:*:*:*:*:*:*

More vulnerabilities in Owasp Defectdojo

CVE-2023-48171 — High (CVSS 8.8): An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions…

All CVEs affecting Owasp Defectdojo →

Other CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerabilities

CVE-2026-49777 — Critical (CVSS 10.0): Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for…
CVE-2024-8887 — Critical (CVSS 10.0): CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with…
CVE-2022-20699 — Critical (CVSS 10.0): Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker…
CVE-2021-21960 — Critical (CVSS 10.0): A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect…
CVE-2021-21951 — Critical (CVSS 10.0): An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the…
CVE-2021-21950 — Critical (CVSS 10.0): An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the…

Browse all CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerabilities →