CVE-2026-94440
EPSS 0.5%Real vendor advisory with patch; low EPSS; no KEV, PoC, or exploitation evidence.
What: Multipart form parsing memory-limit bypass in Google Apigee hybrid v1.15.8 and earlier; allows reading arbitrarily long lines into memory when remaining limit <400 bytes. CVSS and EPSS unavailable.
Why it matters: Google released Apigee hybrid v1.15.9 on October 21, 2026 addressing this vulnerability across multiple components (runtime, udca, prometheus-adapter, fluent-bit, cassandra-client). Vendor patching confirms real issue, but no KEV listing, public PoC, or in-the-wild exploitation reports in social chatter.
Where it's seen: Bulk vendor advisory posts on Bluesky listing CVE-2026-94440 alongside patch releases; no independent researcher commentary, exploit discussion, or defender triage activity observed.
RISK: MODERATE — Vendor patched promptly; memory-exhaustion class; no active exploitation signal yet.
Description
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.