CVE-2026-112779
Deferred Deferred - Pending Action

Memory Exhaustion in Grav API Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112779
EUVD
EUVD-2026-104585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api 1.0.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Grav API plugin (grav-plugin-api) versions 1.0.16 to 1.0.41 allows unauthenticated attackers to send crafted requests to the GET /api/v1/translations/{lang} endpoint, which caches a full translation dictionary for any valid language code. This can exhaust disk space or APCu memory. Users with api.pages.write permissions can exploit POST /api/v1/pages/{route}/sync and POST /api/v1/pages/batch endpoints to bypass page rules and create unauthorized pages or modify translations.

Detection Guidance

Check Grav API plugin version with: composer show grav-plugin-api. Monitor disk space and APCu cache usage for unexplained growth. Inspect web server logs for repeated GET /api/v1/translations/{lang} requests with varied language codes.

Impact Analysis

Unauthenticated attackers can cause denial of service by filling disk or APCu cache. Users with write permissions may overwrite translations or create pages that violate page-level rules. This could lead to data corruption, unauthorized access, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of translations and page content, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Cache exhaustion attacks may disrupt system availability, impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.42 or later immediately. Restrict access to /api/v1/translations/{lang} endpoint via firewall or server configuration. Review and tighten api.pages.write permissions to prevent unauthorized page creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112779. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart