CVE-2026-103471

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103471

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103471.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103471

Published

2026-09-30T17:22:38Z

Modified

2026-10-02T03:47:01Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

Details

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103471.json"
}

References

Affected packages

Git / github.com/corvusoft/restbed

Affected ranges

Type

GIT

Repo

https://github.com/corvusoft/restbed

Events

Introduced

Fixed

e1227a297ce6d4e9f78222456507b29bb8ab77e9

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "5.0.0"
        },
        {
            "fixed":  "5.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*

1.0

2.*

2.0

2.5

3.*

3.0

3.5

4.*

4.0

4.5

4.5-RC1

4.7

4.8

4.8-RC1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103471.json"