CVE-2026-47216: Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint

Synopsis

An unauthenticated denial-of-service vulnerability exists in the Typesense search engine's /multi_search endpoint. A specially crafted HTTP request triggers an unhandled exception during request processing, causing the server process to terminate abruptly. No credentials or user interaction are needed, and successful exploitation results in complete service unavailability. The description notes fix versions 29.1 and 30.2 exist upstream; however, no patched-image rebuild is currently available on HarborGuard because no fix versions have been formally published in the advisory feed yet, and HarborGuard is tracking the advisory for confirmation.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Typesense service over the network to send a crafted HTTP request to the /multi_search endpoint (AV:N).

• AuthenticationNot required

  No credentials of any privilege level are needed; the /multi_search endpoint accepts and processes the malicious request without authentication (PR:N).

• Victim interactionNot required

  No user or administrator action is required; the attacker triggers the vulnerability entirely through their own request (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or special environmental setup beyond network access to the endpoint (AC:L).

Blast Radius

• The Typesense server process terminates immediately upon receiving the crafted request, taking the search service offline.
• All queries in flight at the time of the crash are dropped, returning errors to any application or user relying on the search endpoint.
• Depending on restart configuration and dataset size, the service may remain unavailable for an extended period while the process recovers and reloads its index.