CVE-2026-33582: Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

June 9, 2026 (updated July 31, 2026)

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

github.com/advisories/GHSA-v553-g2w6-295p
github.com/apache/answer/commit/cfc3e54f30cc5e01afb7110ecc1da9152d0a3a41
github.com/apache/answer/releases/tag/v2.0.1
lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z4st1kbq
nvd.nist.gov/vuln/detail/CVE-2026-33582

Code Behaviors & Features

Detect and mitigate CVE-2026-33582 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →