CVE-2026-11460: Boost Serialization Insecure Deserialization
| Field | Value |
|---|---|
| CVE ID | CVE-2026-11460 |
| CVSS score | 7.3 |
| Attack vector | Remote |
| Auth required | Unknown from published primary data; defenders should assume none if untrusted input is accepted |
| Patch status | No patch currently available |
| Affected versions | Boost Serialization up to and including 1.91 |
| Fixed version | None confirmed as of 2026-06-07 |
TL;DR - CVE-2026-11460 affects Boost Serialization up to 1.91 and involves improper validation of serialized input types. - Public exploit information exists, but in-the-wild exploitation is not confirmed. - No patch is available, so exposure reduction and input isolation are urgent.
Vulnerability at a Glance
CVE-2026-11460 is a high-severity flaw in Boost Serialization, a component of the Boost C++ Libraries used to serialize and deserialize object graphs in C++ applications. NVD describes the issue as improper validation of a specified type of input and states that the attack can be initiated remotely. Public reference material also points to insecure deserialization and memory-based confusion attacks.
For defenders, the practical issue is straightforward: if an application accepts attacker-controlled serialized data and passes it into Boost Serialization, that input path may become a security boundary failure. Even though the exact internal function was not identified in the available source material, the risk is not theoretical. NVD explicitly says the exploit has been published and may be used, which materially lowers the barrier for testing and opportunistic attacks.
What This Vulnerability Means in Practice
This is not just a library bug with academic impact. Boost Serialization is often embedded several layers deep inside applications, middleware, custom services, or file-processing pipelines. Many organizations will not have a direct asset inventory entry labeled “Boost Serialization,” even if internally developed or third-party software relies on it. That makes this CVE easy to miss in traditional scanner-first workflows.
The core risk pattern is unsafe deserialization of untrusted or semi-trusted data. If your service ingests serialized objects over the network, processes uploaded files, consumes brokered messages, or imports project/state bundles from external users, you should treat that path as potentially exposed. Because no official patch is available, the immediate security task is not routine patching but identifying reachable deserialization flows and reducing attacker control over those inputs.
Affected Products and Version Range
The affected product is Boost Serialization, part of the broader Boost C++ Libraries project. Based on the available published information, the confirmed affected range is “up to and including 1.91.” The supplied primary-source-backed data does not confirm a lower bound, so it is not safe to claim exactly when the vulnerable behavior was introduced.
The fixed version is also not known. As of 2026-06-07, the defensible statement is: there is no confirmed fixed release, and no patch is currently available. If your dependency inventory shows Boost Serialization 1.91 or earlier, you should assume potential exposure until upstream publishes remediation guidance. In the absence of a fixed version, defenders should prioritize compensating controls and architectural containment.
Severity and Exploitation Status
The published severity is CVSS 7.3, which places this issue in a high-severity range. The exact CVSS vector string was not confirmed in the provided primary data, so it would be inappropriate to invent values for attack complexity, privileges required, user interaction, or impact metrics. Still, NVD’s description that the attack is remotely initiated is enough to elevate operational urgency.
On exploitation status, the picture is mixed but important. A public PoC or exploit reference exists, and NVD explicitly states that “the exploit has been published and may be used.” At the same time, exploitation in the wild is not confirmed from CISA KEV data, because the CVE is not listed there as of the publication date. The correct practitioner framing is: public exploit information exists; active exploitation is plausible; broad in-the-wild exploitation is not currently confirmed from KEV.
What Defenders Should Do Next
First, inventory every application that uses Boost Serialization and classify whether it processes untrusted, semi-trusted, or fully trusted serialized input. This triage determines your response priority far better than the CVSS score alone. A back-office batch job consuming only internal artifacts is not equivalent to a public API or client application that opens external files.
Second, implement containment before waiting for a patch. Disable unused deserialization features, block unnecessary network paths, add logging around parser entry points, and increase crash visibility. Because a public exploit exists and there is no patch, this is exactly the kind of issue where compensating controls matter most in the first days after disclosure.
How to Find Exposure in Your Environment
Start with software composition analysis, build manifests, and source code search. Search for direct or transitive use of Boost Serialization headers, archives, and serialization routines in internal code and third-party products. Focus less on the library name alone and more on actual data flow: where does the application deserialize data, and can a user, partner, device, or external system influence that payload?
Next, identify trust boundaries. Systems that only deserialize local, developer-generated test data are lower risk than internet-facing APIs, desktop clients that open untrusted project files, CI systems that process external artifacts, or backend services consuming messages from mixed-trust sources. If you cannot quickly determine whether the input is attacker-controlled, assume it may be. In the absence of a patch, exposure scoping is your highest-value action.
Technical Notes
Look for code and package indicators such as the following:
# Search source trees for Boost Serialization usage
grep -RInE 'boost/(archive|serialization)/|BOOST_CLASS_EXPORT|text_iarchive|binary_iarchive|xml_iarchive' /srv/repos /opt/src 2>/dev/null
# Search common build manifests and vendored libraries
find /srv /opt /home -type f \( -name "CMakeLists.txt" -o -name "vcpkg.json" -o -name "conanfile.*" -o -name "Dockerfile" \) -print0 | \
xargs -0 grep -RInE 'boost|serialization' 2>/dev/null
A practical detection query for Linux EDR or centralized logs is to hunt for crashes in processes known to parse serialized content:
# systemd journal example: recent faults in a target service
journalctl -u your-service --since "7 days ago" | grep -Ei 'segfault|abort|stack smashing|invalid read|invalid free|assert'
Concrete log patterns worth alerting on include:
segfault at
dropped by signal 11
double free or corruption
malloc(): invalid size
Assertion `.*archive.*' failed
If the vulnerable application receives serialized objects over HTTP or a custom TCP protocol, also look for repeated malformed requests followed by worker crashes, restarts, or memory exceptions. There is no authoritative network signature in the source material, so defenders should build service-specific detections around “malformed serialized payload followed by process instability.”
Detection and Monitoring Strategy
Detection here is less about a universal IDS signature and more about correlating three facts: the application uses Boost Serialization, an untrusted input path exists, and the process shows error behavior when handling crafted content. If you run reverse proxies, API gateways, or message brokers in front of these applications, preserve request metadata so you can tie suspicious inputs to downstream crashes or anomalous latency spikes.
You should also monitor for abnormal restart loops and sandbox escapes in components that deserialize complex objects. Even if the exploit outcome in your environment is only denial of service, repeated crashes on a remotely reachable parser can still create an availability incident. Where serialized input is expected only from trusted producers, any deviation in source IP, client certificate, tenant, or message origin should be treated as suspicious until verified.
Technical Notes
A simple Sigma-style detection concept for Linux process crash correlation might look like this:
title: Possible exploitation attempts against Boost Serialization consumer
logsource:
product: linux
detection:
selection:
Message|contains:
- "segfault at"
- "double free or corruption"
- "malloc(): invalid"
- "signal 11"
condition: selection
level: medium
For network-facing services behind NGINX, pair application crash telemetry with bursts of 4xx/5xx responses:
# Example quick triage: correlate upstream 5xx spikes with client sources
awk '$9 ~ /^5/ {print $1, $4, $7, $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
This is not a signature for CVE-2026-11460 specifically, but it is a concrete way to identify likely probing against a fragile deserialization endpoint when no vendor-provided detection content exists.
Mitigation and Patching
There is no confirmed patch or fixed version for CVE-2026-11460 at this time. That means standard “upgrade to version X” guidance is not available yet. If you see advice claiming a fixed release number without an upstream or authoritative advisory to back it, treat it with caution. For now, mitigation means reducing exposure, constraining input, and isolating failure domains.
The strongest mitigation is to prevent untrusted data from reaching Boost Serialization deserializers in the first place. If that is not feasible, introduce validation layers before deserialization, enforce strict type allow-listing where your architecture supports it, and isolate the parsing component in a low-privilege process or container. Internet-exposed services that deserialize user-supplied content should be considered highest priority for network restrictions, segmentation, and runtime hardening.
Technical Notes
If you can disable or gate a vulnerable code path, make the change explicit in deployment steps. For example, if deserialization support is controlled through a feature flag or service config:
# Example: disable import endpoint and restart service
sudo sed -i 's/^enable_object_import=.*/enable_object_import=false/' /etc/yourapp/yourapp.conf
sudo systemctl restart yourapp
If the service is externally reachable, restrict network access immediately while you assess impact:
# Example: limit access to a deserializing service on TCP/9000
sudo iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9000 -j DROP
If your environment builds Boost from source, you can at least inventory installed versions even though no fixed version exists:
# Example: identify installed Boost version from headers
grep -R "BOOST_LIB_VERSION" /usr/include/boost/version.hpp /usr/local/include/boost/version.hpp 2>/dev/null
In containerized deployments, redeploy the parsing service under tighter confinement:
# Example docker run hardening pattern
docker run --read-only --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 512m your-image:tag
These are compensating controls, not a substitute for an upstream fix. Track the Boost Serialization issue and NVD record for official remediation.
References
The key public references associated with this CVE are the NVD record, the public gist referenced by NVD, and the upstream Boost Serialization issue:
- NVD CVE entry for CVE-2026-11460
- Public exploit/disclosure reference: Public PoC Gist
- Upstream issue: Boost Serialization Issue
- Boost project: Boost Libraries
Because some upstream content was not fully extractable from the available tooling, the safest practitioner stance is to rely on the confirmed facts only: Boost Serialization up to 1.91 is affected, remote exploitation is described as possible, public exploit information exists, and no patch is currently available.
For more information on related topics, check out our articles on Authentication vs Authorization and What is Chain of Custody.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.