CVE-2026-25957: Cube Core is vulnerable to Denial of Service (DoS) via crafted request

<strong>Impact</strong>

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

• 1.5.13 and later (regular release)
• 1.4.2 (active LTS release)

<strong>References</strong>

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.