CVE-2026-19500

Deferred Deferred - Pending Action

Entries Component Resource Exhaustion in SureForms

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: CERT/CC

Description

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19500

EUVD

EUVD-2026-60968

Affected Vendors & Products

Vendor	Product	Version / Range
brainstorm_force	sureforms	to 2.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

The vulnerability in Brainstorm Force SureForms versions before 2.1.3 involves insufficient restrictions on user-controlled form fields and submitted content. This allows attackers to send excessive data, consuming server resources and causing administrators to lose access to the Entries interface due to HTTP 500 errors.

Detection Guidance

Monitor for HTTP 500 errors or slow performance in the Sureforms Entries interface. Check server resource usage spikes during form submissions. Use the provided PoC script from the GitHub repository to test if your system is vulnerable by submitting large key-value pairs repeatedly.

Impact Analysis

This vulnerability can lead to denial of service by crashing the server or making it unresponsive. Administrators may be unable to view or manage form submissions, disrupting normal operations. Users might experience errors or downtime when accessing the affected system.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. Resource exhaustion may prevent authorized access to entries, violating requirements for timely data access and processing under these regulations.

Mitigation Strategies

Update SureForms to version 2.1.3 or later to enforce proper limits on form fields and submissions. Monitor server resources for unusual spikes or HTTP 500 errors that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-19500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70