Skip to content

Vendor

crate vulnerabilities

3 published CVES affecting crate, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of crate alerts

Products

Latest crate CVEs

Newest publication first

  1. CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization

    Published
    HighCVSS 7.1

    CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage...

  2. CVE-2024-37309 Client initialized Session-Renegotiation DoS

    Published
    MediumCVSS 5.3

    CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of...

  3. CVE-2024-24565 CrateDB database has an arbitrary file read vulnerability

    Published
    MediumCVSS 6.5

    CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.