High severity8.1GHSA Advisory· Published Oct 7, 2026

CVE-2026-62251

Description

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.

Affected products

Sipcapture/HomerGHSA
Range: < 0.0.0-20260625085520-a7d027dc684b
Homer/Homerllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-f46q-3v67-fmm4ghsaADVISORY
github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0nvd
github.com/sipcapture/homer/pull/837nvd
github.com/sipcapture/homer/releases/tag/11.0.283nvd
github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000