CVE-2026-54135

AirSane, a SANE frontend and scanner server that supports Apple's AirScan (eSCL) protocol, contains a flaw in its custom HTTP server: the HttpServer::Request::content function in httpserver.cpp reads the Content-Length header and passes the value directly to std::string::resize() with no upper-bound validation or safe parsing. A remote, unauthenticated attacker can send an HTTP POST with an artificially large Content-Length, forcing the daemon to attempt allocating gigabytes of memory, which raises a std::bad_alloc exception and immediately crashes the process; non-numeric Content-Length values additionally trigger undefined behavior (NaN-to-integer conversion) due to missing parse error handling. The attacker gains denial of service only — the CVSS vector confirms high availability impact with no confidentiality or integrity impact. Anyone running AirSane prior to 0.4.12, typically self-hosted on Linux/Unix machines or NAS-style devices to share scanners over the network, is affected. Exploitation is not currently observed: the issue is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade AirSane to version 0.4.12 or later, which adds validation and safe parsing of the Content-Length header. Where upgrading is not immediately possible, restrict access to the AirSane HTTP service with firewall rules to trusted LAN clients only, and configure service monitoring/auto-restart so crashes are quickly recovered. Check deployments for exposed scanner servers by inventorying hosts running the airsane daemon and confirming their installed version.