CVE-2026-54734

10.0 Critique

Publiée le 18/09/2026 à 00:17 · Modifiée le 23/09/2026 à 20:12 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.

Traduire en français

Produits concernés

prebid-server-java

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-918

Références

https://github.com/prebid/prebid-server-java/commit/a129a685b6fc54441c1a779ce29ea4ec20c2e09f
https://github.com/prebid/prebid-server-java/commit/d0c723ce36aa09712c825ea9625d978f45d29a1c
https://github.com/prebid/prebid-server-java/pull/4522
https://github.com/prebid/prebid-server-java/releases/tag/3.43.0
https://github.com/prebid/prebid-server-java/security/advisories/GHSA-fr2c-g2f8-qchg

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories