Resource Exhaustion Vulnerability in BlueprintUE Self-Hosted Edition by BlueprintUE

CVE-2026-126659

What is CVE-2026-126659?

BlueprintUE Self-Hosted Edition versions prior to 4.3.5 are susceptible to a resource exhaustion vulnerability. This flaw enables unauthenticated attackers to exploit the system by repeatedly creating anonymous blueprints, which consume server storage. Attackers can bypass normal purging mechanisms by sending large requests to the HomeController's doProcessCreateBlueprint() method with a 'never' expiration, leading to potential denial of service as the server's disk fills.

References