CVE-2026-27824: calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's…

PriorityP430medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.15%

4.4th percentile

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
calibre-ebook	calibre	< 9.4.0	9.4.0
debian	calibre	< calibre 9.4.0+ds+~0.10.5-1 (forky)	calibre 9.4.0+ds+~0.10.5-1 (forky)
kovidgoyal	calibre	< 9.4.0	9.4.0
kovidgoyal	calibre	>= 0 < 9.4.0+ds+~0.10.5-1	9.4.0+ds+~0.10.5-1

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

osv5.3MEDIUM

vendor_debian5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.