CVE-2026-90784
Deferred Deferred - Pending Action

Memory Leak in flatcc up to 0.6.3

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8dbc3419738da066151991fd2bf1d0c85591dea2. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90784
EUVD
EUVD-2026-77466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dvidelabs flatcc to 0.6.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the Dvidelabs flatcc library up to version 0.6.3. It occurs in the fb_clear_parser function in src/Compiler/semantics.c where allocated memory for the keyword table is not properly freed during parser cleanup. This leads to gradual memory consumption in long-running processes.

Detection Guidance

To detect this memory leak vulnerability in flatcc, monitor memory usage of processes using flatcc for abnormal growth over time. Use tools like Valgrind or AddressSanitizer (ASAN) to detect memory leaks during execution. For example, compile with ASAN flags and run: ASAN_OPTIONS=detect_leaks=1 ./your_flatcc_application. Check for repeated schema parsing operations that may indicate the leak.

Impact Analysis

The memory leak can cause gradual memory exhaustion in applications using flatcc that repeatedly parse schemas, such as fuzzers or daemons. This may lead to performance degradation, crashes, or denial of service due to resource exhaustion. The leak is approximately 1KB per parse operation.

Compliance Impact

This vulnerability causes a memory leak in the flatcc library, which could lead to unbounded memory growth in persistent processes. While not directly impacting GDPR or HIPAA compliance, such resource exhaustion could indirectly affect system availability and stability, potentially violating requirements for secure and reliable processing of sensitive data under these regulations.

Mitigation Strategies

Immediately update flatcc to the patched version by applying the commit 8dbc3419738da066151991fd2bf1d0c85591dea2 or upgrading to a version that includes this fix. If updating is not possible, disable or restrict usage of flatcc in persistent processes until patched. Monitor memory usage closely for signs of the leak.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90784. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart