{"id":"CVE-2026-79896","published":"2026-10-01T16:17:59.940","lastModified":"2026-10-01T20:34:26.287","description":"Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2026-016","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Fortra BoKS Manager has an out-of-bounds read vulnerability in its TLS ClientHello parser that can cause the boks_portmux daemon to crash and restart, leading to service interruption. This allows remote attackers to disrupt the service without authentication.","exploitability":"Exploitation is relatively straightforward as attackers only need to send a malformed TLS ClientHello to trigger the out-of-bounds read, requiring no authentication or user interaction.","blast_radius":"The impact is moderate as repeated exploitation attempts can sustain service interruption, but the daemon automatically restarts, limiting persistent damage.","remediation":"Upgrade to BoKS Manager version 2.590 or later to address this vulnerability.","detection":"Monitor for boks_portmux process crashes and restarts in system logs, particularly around TLS handshake attempts from external IP addresses.","tags":["tls","denial-of-service","remote"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:05:02.075Z"}}