{"id":"CVE-2026-103471","published":"2026-09-30T18:18:17.163","lastModified":"2026-09-30T20:17:31.283","description":"restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Corvusoft/restbed","tags":[]},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/service_impl.cpp#L554","tags":[]},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/session.cpp#L200","tags":[]},{"url":"https://github.com/Corvusoft/restbed/issues/558","tags":[]},{"url":"https://www.vulncheck.com/advisories/restbed-through-5.0.0-denial-of-service-via-unbounded-header-buffering","tags":[]},{"url":"https://github.com/Corvusoft/restbed/issues/558","tags":[]}],"exploitRefs":[{"url":"https://github.com/Corvusoft/restbed","tags":[]},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/service_impl.cpp#L554","tags":[]},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/session.cpp#L200","tags":[]},{"url":"https://github.com/Corvusoft/restbed/issues/558","tags":[]},{"url":"https://github.com/Corvusoft/restbed/issues/558","tags":[]}],"hasPoc":true,"ai":{"summary":"The restbed library fails to enforce maximum size limits on HTTP request headers, allowing attackers to stream unlimited data without sending header delimiters, leading to unbounded heap memory allocation and potential server memory exhaustion.","exploitability":"Exploitation is straightforward for remote unauthenticated attackers who can open TCP connections and stream data indefinitely, with no special preconditions required beyond network access to the vulnerable service.","blast_radius":"The impact could be significant across any application using restbed 5.0.0 or earlier, potentially causing widespread service disruption through memory exhaustion attacks that are difficult to detect until they've already occurred.","remediation":"Upgrade to restbed version 5.0.1 or later to address the header buffer size limitation issue.","detection":"Monitor for abnormal memory usage patterns in processes using restbed, particularly sudden increases in heap allocation or process restarts due to memory exhaustion, though no specific log entries or network indicators are mentioned in the description.","tags":["memory-exhaustion","http","denial-of-service","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:08:58.430Z"}}