CVE-2026-27824
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.
Published Feb 27, 2026 · updated Jun 17, 2026 · calibre-ebook calibre
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both and the header. Since the header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 27, 2026 · NIST NVD
Detected
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both and the header. Since the header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changi
Jun 17, 2026 · NIST NVD
Updated
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both and the header. Since the header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changi
Affected
- cpe calibre-ebook/calibreversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27824
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both and the header. Since the `X
nvd.nist.gov