Denial of Service in Parse Server by Parse Community
CVE-2026-110854

8.2HIGH

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110854?

A critical flaw in Parse Server results from inadequate error handling during email verification and password reset processes. Specifically, when an email fails due to factors such as a rejected, rate-limited, or unavailable mail provider, the server process may crash. This vulnerability allows clients with only public application keys to potentially exploit the server by triggering email send requests and subsequently causing service disruptions.

Affected Version(s)

parse-server 0 < 8.6.97

parse-server 9.0.0 < 9.10.2-alpha.6

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-before-...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
AdrianCurtin
.