Executive brief
Parseable is a log analytics platform that ingests and processes large volumes of log data. An unauthenticated attacker can crash the service by sending specially crafted HTTP headers with invalid data, causing service interruptions and potential container restarts that disrupt business operations.
Technical details
The HTTP middleware in Parseable prior to 3.0.0 uses Rust's unwrap() function to parse the x-amz-firehose-common-attributes header before authentication checks, creating a panic condition. An attacker can send non-UTF-8 data, malformed JSON, or invalid derived header values to trigger the panic and deny service through repeated requests or restart loops. The vulnerability is resolved in version 3.0.0 by removing unsafe unwrap() calls in the middleware.
Affected products
- Parseable Parseable before 3.0.0
Timeline
- 2026-09-18: disclosed
- 2026-03-13: patched: Fix merged in version 3.0.0