CVE-2026-3816: owasp defectdojo Improper Resource Shutdown or Release

Vulnerability summary

CVE-2026-3816 is a medium (CVSS 6.5) Improper Resource Shutdown or Release vulnerability in owasp defectdojo. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-03-2026
   PublishedVulnerability first disclosed.
2. 09-03-2026
   Last modifiedVulnerability information updated.

Description

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.