CVE-2026-27460 MEDIUM

CVE-2026-27460: Tandoor Recipes Affected by Denial of Service via Recipe Import

Vendor Tandoorrecipes

Product recipes

Weakness CWE-409

Published April 10, 2026

Last update April 13, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly degrade its performance by uploading a large size ZIP file (ZIP Bomb). This vulnerability is fixed in 2.6.5.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-27460 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/409.html

Related vulnerabilities

04Related CVE

CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS CVE-2026-1526 undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression CVE-2026-27809 psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame