AIKIDO-2026-10750

TL;DR

Affected versions of this package contain an unauthenticated denial-of-service vulnerability in the LongPoll transport. The application/x-ndjson POST handling allows a remote attacker to trigger excessive memory allocation with crafted requests. Because only a session token is required—and can be obtained via a simple GET request—this can be exploited without authentication.