{"id":"CVE-2026-24874","summary":"Type confusion in xray-monolith","details":"Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.","modified":"2026-09-02T03:31:00.595477003Z","published":"2026-01-27T15:55:03.021Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24874.json","cna_assigner":"GovTech CSG","cwe_ids":["CWE-843"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24874.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24874"},{"type":"FIX","url":"https://github.com/themrdemonized/xray-monolith/pull/399"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/themrdemonized/xray-monolith","events":[{"introduced":"0"},{"fixed":"1132a3f68c08c429f732fc12eb1e236700dd2611"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:themrdemonized:xray-monolith:*:*:*:*:*:s.t.a.l.k.e.r._anomaly:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2025.12.30"}]}}],"versions":["2025.12.23","2025.12.3","2025.11.17","2025.10.28","2025.9.19","2025.10.23","2025.9.28","2025.9.26","2025.9.15","2025.9.12","2025.9.10","2025.9.6","2025.8.31","2025.8.30","2025.8.27","2025.8.23","2025.8.21","2025.8.19","2025.8.12","2025.8.11","2025.8.9","2025.8.8","2025.8.7","2025.8.4","2025.8.1","2025.7.31","2025.7.29","2025.7.27","2025.7.26","2025.7.23","2025.7.20","2025.7.19","2025.7.16","2025.7.15","2025.7.14","2025.7.12","2025.7.8","2025.6.21","2025.7.6","2025.7.5","2025.7.3","2025.7.2","2025.7.1","2025.6.30","2025.6.28","2025.6.27","2025.6.26","2025.6.24","2025.6.23","2025.6.20","2025.6.18","2025.6.15","2025.6.13","2025.6.11","2025.6.9","2025.6.8","2025.6.5","2025.6.3","2025.5.29","2025.5.26","2025.5.24","2025.5.19","2025.5.16","2025.5.10","2025.5.12","2025.5.7","2025.5.6","2025.5.3","2025.5.1","2025.4.28","2025.4.27","2025.4.25","2025.4.22","2025.4.21","2025.4.19","2025.4.18","2025.4.15","2025.4.14","2025.4.13","2025.4.11","2025.4.5","2025.4.4","2025.4.3","2025.3.29","2025.3.22","2025.3.21","2025.3.18","2025.3.17","2025.3.16","2025.3.15","2025.3.14","2025.3.13","2025.3.12","2025.3.9","2025.3.7","2025.3.6","2025.2.22","2025.2.28","2025.2.25","2025.2.19","2025.2.7","2025.1.26","2025.1.24","2025.1.22","2025.1.19","2025.1.17","2025.1.13","2024.12.11","2024.12.10","2024.12.9","2024.11.30","2024.11.27","2024.11.24","2024.11.23","2024.11.10","2024.11.9","2024.11.8","2024.11.4","2024.11.2","2024.11.1","2024.10.28","2024.10.26","2024.10.22","2024.10.19","2024.10.18","2024.10.14","2024.10.10","2024.10.7","2024.10.6","2024.10.5","2024.9.20","2024.10.1","2024.9.29","2024.9.28","2024.9.25","2024.9.23","2024.9.19","2024.9.15","2024.9.14","2024.9.12","2024.9.9","2024.9.8","2024.9.7","2024.9.6","2024.9.4","2024.9.3","2024.9.2","2024.8.25","2024.8.20","2024.8.19","2024.8.18","2024.8.10","2024.8.4","2024.7.21","2024.7.6","2024.7.5","2024.6.12","2024.5.31","2024.5.30","2024.5.27","2024.5.23","2024.5.21","2024.5.20","2024.5.15","2024.5.11","2024.5.7","2024.5.6","2024.5.3","2024.5.1","2024.4.22","2024.4.17","2024.4.13","2024.4.12","2024.4.7","2024.4.6","2024.4.5","2024.4.3","2024.4.1","2024.3.30","2024.3.26","2024.3.24","2024.3.18","2024.3.21","2024.3.20","2024.3.12","2024.3.11","2024.3.8","2024.3.5","2024.2.28","2024.2.5","2024.2.1","2024.1.31","2024.1.30","2024.1.27","2024.1.26","2024.1.22","2024.1.18","2024.1.13","2024.1.11","2024.1.4","2023.12.30","2023.12.24","2023.12.23","2023.12.17","2023.12.16","2023.12.9","2023.12.6","2023.12.2","2023.11.28","2023.11.25","2023.11.22","2023.11.15","2023.11.14","2023.11.12","2023.10.26","2023.10.20","2023.10.17","2023.10.5","2023.9.30","2023.9.22","2023.9.6","2023.09.05"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24874.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}