CVE Intelligence
Analysis AI-assisted

CVE-2026-24874: Themrdemonized xray-monolith Type Confusion Vulnerability

CVE-2026-24874 is a type confusion weakness (CWE-843) in the xray-monolith project by themrdemonized, affecting versions before 2025.12.30. NVD and the CNA both list a CVSS 3.1 score of 9.1 (critical), with a network attack vector and no privileges or user interaction required according to the vector. The CISA KEV catalog does not list it, no confirmed exploitation appears in the sources consulted, and the referenced pull request is the listed patch.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24874 describes a type confusion issue (CWE-843, 'Access of Resource Using Incompatible Type') in xray-monolith by themrdemonized. The record states that the issue affects versions before 2025.12.30 and links a pull request in the project repository as the patch reference.

Impact

The NVD and CNA records score the issue CVSS 3.1 9.1 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Under this vector, confidentiality and integrity impact are high and availability impact is none. The record does not describe the concrete consequences of the type confusion beyond this scoring.

Affected products and versions

  • Product: Themrdemonized Xray-monolith
  • Affected range: versions less than 2025.12.30
  • Fixed version: not explicitly stated. The affected range implies 2025.12.30 as the first unaffected version, and the record links patch pull request 399.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Identify deployments of xray-monolith and their installed version.
  • Upgrade to version 2025.12.30 or later, as the affected range indicates.
  • Review the patch pull request to confirm the change is present in your version.
  • Where upgrading is not immediately possible, restrict exposure of the affected component to trusted users and networks until it is updated.

Detection guidance

  • Inventory software to locate xray-monolith installations and their version strings.
  • Monitor for unexpected crashes or abnormal behavior in the component. Such events may point to type handling problems but are not proof of compromise on their own.

Limitations of the available information

The record provides a short description, a CVSS vector, the affected range and one patch reference. It does not describe the triggering conditions, the affected code paths, the attack scenario or any vendor advisory text. The 2025.12.30 boundary is inferred from the affected range. Check the NVD entry for updates.

Frequently asked questions

Which versions of xray-monolith are affected by CVE-2026-24874?

The record lists versions less than 2025.12.30 as affected. Versions from 2025.12.30 onward are not listed as affected, but the record does not state the fixed version explicitly.

Is CVE-2026-24874 known to be exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.