Parseable, a log analytics platform, contains a bug in the middleware that parses the x‑amz‑firehose‑common‑attributes header. The code uses unwrap() on the header value before authentication. An unauthenticated attacker can supply data that is not UTF‑8, malformed JSON, or otherwise invalid, causing the Rust runtime to panic. The panic terminates request processing and can repeat on successive requests, resulting in a denial of service or even container restart loops.

The vulnerability exists in all ParseableHQ Parseable releases prior to version 3.0.0. Any deployment running an earlier version of the platform is affected, including the public repository's releases before v3.0.0.

The CVSS score of 7.5 indicates high severity, and the vulnerability can be exploited remotely without authentication by sending crafted headers. EPSS is not available, and the issue is not listed in CISA's KEV catalog. Because the bug lies in unchecked header parsing, the attack surface is the public network interface of the Parseable service; repeated malicious requests can exhaust service resources or trigger container restarts.