CVE-2026-88290CWE-400denial-of-service

CVE-2026-88290

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-10T13:17Z
References (1)
https://www.geovision.com.tw/cyber_security.php · 0df08a0e-a200-4957-9bb0-084f562506f9
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 08:26Z
    GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion
    cvelistv5