What is CVE-2026-62251?

CVE-2026-62251 is a high-severity vulnerability in Sipcapture Homer, classified under SQL Injection. CVSS score: 8.1/10. Published 2026-10-07.

How severe is CVE-2026-62251?

High severity. CVSS v3 base score is 8.1 out of 10.

SQL Injection in Sipcapture Homer

CVE-2026-62251

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

Vulnerability class: SQL Injection

Published 2026-10-07.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Sipcapture Homer — versions < 11.0.283

Weakness classification (CWE)

CWE-89 — SQL Injection

References

Frequently asked questions

What is CVE-2026-62251?: CVE-2026-62251 is a high-severity vulnerability in Sipcapture Homer, classified under SQL Injection. CVSS score: 8.1/10. Published 2026-10-07.
How severe is CVE-2026-62251?: High severity. CVSS v3 base score is 8.1 out of 10.