CVE-2026-11460: Boost Serialization improper validation of specified type of input
A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Boost Serializationfrom your environment.Uninstall or remove the Boost Serialization component from systems and applications where it is not required to eliminate exposure to the vulnerability (affects Boost Serialization up to 1.91).
- Configuration
Disable processing of Boost Serialization serialized input or explicitly reject serialized data from untrusted sources; if the application exposes an API that accepts serialized data, disable or remove that API until a safe fix is available.
Application using Boost Serialization accept_serialized_input = disabled - Compensating control
Restrict network exposure of services that accept Boost Serialization input. Apply firewall rules, ACLs or WAF protections to allow only trusted hosts/IPs to reach those endpoints and block untrusted remote access (the flaw can be exploited remotely).
- Operational
Increase monitoring and detection for exploitation attempts (the exploit has been published). Review logs for suspicious deserialization activity, deploy IDS/IPS or signature-based detections, and track vendor/maintainer announcements for an official patch; apply the patch as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11460?
The severity of CVE-2026-11460 is rated as high with a score of 7.3.
How do I fix CVE-2026-11460?
To fix CVE-2026-11460, upgrade to the latest version of Boost Serialization that addresses this vulnerability.
What type of flaw is associated with CVE-2026-11460?
CVE-2026-11460 is associated with improper validation of specified types of input.
Can CVE-2026-11460 be exploited remotely?
Yes, CVE-2026-11460 can be exploited remotely.
What versions of Boost Serialization are affected by CVE-2026-11460?
Boost Serialization versions up to 1.91 are affected by CVE-2026-11460.