CVE-2026-103471CWE-770denial-of-service

CVE-2026-103471

High · published September 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-30T22:18Z
References (6)
https://github.com/Corvusoft/restbed · [email protected]https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/service_impl.cpp#L554 · [email protected]https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/session.cpp#L200 · [email protected]https://github.com/Corvusoft/restbed/issues/558 · [email protected]https://www.vulncheck.com/advisories/restbed-through-5.0.0-denial-of-service-via-unbounded-header-buffering · [email protected]https://github.com/Corvusoft/restbed/issues/558 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 17:22Z
    restbed through 5.0.0 Denial of Service via Unbounded Header Buffering
    cvelistv5