CVE-2026-50882: anna-is-cute paste DoS Vulnerability

CVE-2026-50882 Overview

CVE-2026-50882 is a denial of service vulnerability affecting the anna-is-cute paste application version 0.1.1. The flaw resides in the /api/v0/pastes endpoint, where a crafted POST request can exhaust server resources. Attackers can trigger the condition remotely without authentication or user interaction. The issue maps to [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Unauthenticated remote attackers can render the paste service unavailable by sending a single crafted HTTP POST request to the vulnerable API endpoint.

Affected Products

anna-is-cute paste version 0.1.1
Deployments exposing the /api/v0/pastes API endpoint
Self-hosted instances reachable over the network

Discovery Timeline

2026-06-15 - CVE-2026-50882 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50882

Vulnerability Analysis

The vulnerability affects the /api/v0/pastes endpoint of the anna-is-cute paste service at version 0.1.1. The endpoint accepts POST requests intended for creating new paste entries. The application fails to enforce adequate bounds on request processing, allowing a malformed or oversized payload to consume excessive resources. A successful request causes the service to become unresponsive, denying access to legitimate users.

The vulnerability is classified under [CWE-400: Uncontrolled Resource Consumption]. The EPSS data places the exploit probability at 0.324% as of 2026-06-18, reflecting limited observed activity at disclosure. A proof-of-concept is published on a public GitHub Gist.

Root Cause

The root cause is insufficient input validation and resource governance on the paste creation handler. The endpoint does not properly cap request body size, parsing depth, or processing time before committing server resources. This allows a single crafted POST to disproportionately consume CPU, memory, or connection slots.

Attack Vector

An attacker reaches the vulnerable endpoint over the network without prior authentication. The attacker sends a single crafted POST request to /api/v0/pastes. No user interaction is required and the attack complexity is low. The result is loss of availability for the targeted service.

No verified exploitation code is published beyond the linked proof-of-concept gist. See the GitHub Gist PoC for technical details on the request structure.

Detection Methods for CVE-2026-50882

Indicators of Compromise

Unusually large or malformed POST requests targeting /api/v0/pastes
Sudden spikes in CPU or memory utilization on the paste service host
Increased rate of failed health checks or HTTP 5xx responses from the paste API
Repeated POST requests from a single source IP to the paste creation endpoint

Detection Strategies

Inspect web server and application logs for anomalous POST request sizes and payload patterns on /api/v0/pastes
Correlate spikes in request rate with degradation in response latency for the paste endpoint
Apply web application firewall rules to flag POST bodies that exceed expected size thresholds

Monitoring Recommendations

Track request latency and error ratios on the /api/v0/pastes route as a service-level indicator
Alert on sustained high resource utilization tied to the paste application process
Monitor connection pool saturation and worker thread exhaustion on the hosting runtime

How to Mitigate CVE-2026-50882

Immediate Actions Required

Restrict network access to the /api/v0/pastes endpoint through firewall or reverse proxy allow lists
Place the application behind a web application firewall with request size and rate limiting enforcement
Disable or take offline any internet-exposed instance of anna-is-cute paste 0.1.1 pending a fixed release

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-50882. Operators should monitor the project repository for an upstream release that addresses the resource consumption issue and upgrade as soon as a fixed version is available.

Workarounds

Configure a reverse proxy such as nginx to cap client_max_body_size and enforce per-IP rate limits on the paste endpoint
Apply connection and request timeouts at the application or proxy layer to bound processing time per request
Require authentication in front of the paste API where deployment context permits

bash

# Example nginx configuration to limit request size and rate
http {
    limit_req_zone $binary_remote_addr zone=paste_api:10m rate=5r/s;

    server {
        location /api/v0/pastes {
            client_max_body_size 64k;
            limit_req zone=paste_api burst=10 nodelay;
            client_body_timeout 5s;
            proxy_pass http://paste_backend;
        }
    }
}