CVE-2026-50882: An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0

Synopsis

This is a denial-of-service vulnerability in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1. The endpoint is reachable over the network and requires no authentication, meaning any unauthenticated attacker with network access can trigger it by sending a crafted POST request. Successful exploitation crashes or hangs the affected service, making it unavailable to legitimate users. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the host running anna-is-cute paste.

• AuthenticationNot required

  No credentials or session token are needed; the /api/v0/pastes endpoint accepts unauthenticated POST requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the service; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• The targeted service becomes unavailable, denying access to all users for the duration of the attack.
• Availability of stored pastes and any dependent integrations is disrupted until the service is restarted or the attack stops.
• No confidentiality or integrity impact is indicated; data is not read or modified by this exploit.