What is the CVSS score of CVE-2025-70886?

CVE-2025-70886 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Halo are affected by CVE-2025-70886?

A high-severity denial of service vulnerability (CVE-2025-70886) affects Halo v2.22.4 and earlier versions, allowing remote attackers to disrupt service availability through the public comment…

Is there a public PoC exploit available for CVE-2025-70886?

Yes, a public proof-of-concept exploit is available for CVE-2025-70886. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-70886?

Within 24 hours: Identify all Halo instances running v2.22.4 or earlier and assess their criticality; implement WAF rules to block malformed payloads to the comment submission endpoint. Within 7 days: Deploy network segmentation to restrict public access to comment endpoints if non-critical, or implement rate limiting and input validation controls. Within 30 days: Monitor vendor communications for patch availability; evaluate upgrading to patched versions or migrating to alternative solutions if patches remain unavailable.

Halo CVE-2025-70886

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-02-12 cve@mitre.org

Denial Of Service Halo

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 18, 2026 - 15:45 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint

AnalysisAI

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Halo. An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint