CVE-2026-54135: AirSane Scanner Server DoS Vulnerability

CVE-2026-54135 Overview

AirSane is a Scanner Access Now Easy (SANE) frontend and scanner server that implements Apple's AirScan protocol. Versions prior to 0.4.12 contain a resource exhaustion flaw [CWE-400] in the custom HTTP server implementation. A remote unauthenticated attacker can send a crafted HTTP POST request with an oversized Content-Length header, forcing the daemon to allocate gigabytes of memory and crash with a std::bad_alloc exception. The vulnerability is tracked as GHSA-p5hv-3m79-452q and fixed in version 0.4.12.

Critical Impact

Any network-reachable AirSane instance can be crashed by a single unauthenticated HTTP request, disrupting scanner availability across the local network.

Affected Products

• AirSane versions prior to 0.4.12
• Systems exposing the AirSane HTTP server on the local network
• Deployments using AirSane to bridge SANE scanners to AirScan/eSCL clients

Discovery Timeline

• 2026-09-11 - CVE-2026-54135 published to the National Vulnerability Database
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54135

Vulnerability Analysis

The flaw resides in web/httpserver.cpp, specifically in the HttpServer::Request::content function. The function reads the Content-Length header supplied by the client and passes the value directly to std::string::resize() without bounds checking. An attacker can specify a value in the gigabyte range, causing the C++ runtime to attempt an oversized allocation and terminate the process with std::bad_alloc.

A secondary issue exists in header parsing. Non-numeric characters in the Content-Length field are not validated, leading to undefined behavior during NaN-to-integer conversion. This magnifies the reliability impact of malformed requests.

Root Cause

The root cause is missing input validation on an attacker-controlled length field. The custom HTTP server trusts the client-supplied Content-Length value without enforcing an upper bound or verifying that the value is a well-formed integer.

Attack Vector

Exploitation requires only network reachability to the AirSane HTTP listener. No authentication or user interaction is needed. A single malformed POST request is sufficient to crash the daemon and deny scanner service to all clients on the network.

// Patch excerpt from web/httpserver.h
class Request
{
public:
-    explicit Request(std::istream&);
+    Request(std::istream&, int maxLength);
     bool isValid() const { return mValid; }
     const std::string& uri() const { return mUri; }
     const std::string& method() const { return mMethod; }
     const std::string& protocol() const { return mProtocol; }
     const std::string& header(const std::string& s) const;
     const Dictionary& headers() const { return mHeaders; }
-    int contentLength() const;
+    int contentLength() const { return mContentLength; }
     const std::string& content() const;
     bool hasFormData() const;
     const Dictionary& formData() const;

Source: GitHub Commit 129cc3b

The patch introduces a maxLength parameter to the Request constructor and caches mContentLength, enabling an upper-bound check before any allocation occurs. The additional #include <cmath> supports safe numeric parsing of the header value.

Detection Methods for CVE-2026-54135

Indicators of Compromise

• Unexpected termination of the airsaned process with std::bad_alloc messages in system logs
• HTTP POST requests to the AirSane listener containing Content-Length values orders of magnitude larger than the request body
• HTTP requests with non-numeric characters in the Content-Length header
• Repeated scanner service outages coinciding with inbound HTTP traffic from unexpected hosts

Detection Strategies

• Inspect HTTP traffic to AirSane ports for Content-Length values exceeding realistic scan-job sizes
• Alert on service crashes for airsaned in systemd or supervisor logs
• Correlate process restart events with inbound HTTP request patterns to identify abuse

Monitoring Recommendations

• Enable verbose logging on AirSane and forward logs to a centralized SIEM for crash analysis
• Monitor memory allocation spikes on hosts running AirSane
• Track uptime metrics for airsaned and alert on repeated restarts

How to Mitigate CVE-2026-54135

Immediate Actions Required

• Upgrade AirSane to version 0.4.12 or later on all deployed hosts
• Restrict network access to the AirSane HTTP listener using host firewalls or network ACLs
• Audit exposure by scanning for AirSane instances reachable from untrusted network segments

Patch Information

The fix is released in AirSane 0.4.12. See the GitHub Release v0.4.12 and the GitHub Security Advisory GHSA-p5hv-3m79-452q for full details. The upstream commit is 129cc3b, which enforces a maximum request length and validates numeric parsing of the Content-Length header.

Workarounds

• Place AirSane behind a reverse proxy that enforces a strict Content-Length maximum and rejects malformed headers
• Bind the AirSane service to a management interface or loopback where feasible
• Use firewall rules to allow HTTP access only from trusted scanner clients

# Example: restrict AirSane (default TCP/8090) to a trusted subnet using nftables
nft add rule inet filter input tcp dport 8090 ip saddr != 192.0.2.0/24 drop

# Example: NGINX reverse proxy limit to reject oversized bodies before they reach AirSane
# client_max_body_size 25m;
# proxy_pass http://127.0.0.1:8090;