EUVD-2026-33835
GHSA-rwpc-73j7-c566
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function add_review/save_review/get_all_reviews of the file review_app.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.
AnalysisAI
Denial of service conditions in SourceCodester Customer Review App 1.0 can be triggered by a locally authenticated low-privilege user through crafted input to the add_review, save_review, or get_all_reviews functions in review_app.py. Manipulation of the name or comment arguments causes improper resource shutdown or release (CWE-404), resulting in application unavailability. No public exploit identified at time of analysis has crossed into confirmed active exploitation per CISA KEV, but a publicly available proof-of-concept exists on Pastebin (https://pastebin.com/Ud5vaGp6), lowering the bar for reproduction.
Technical ContextAI
The affected application is a Python-based web or desktop utility - review_app.py - authored and distributed by SourceCodester, a known publisher of open-source code samples frequently of low security maturity. The vulnerability class is CWE-404 (Improper Resource Shutdown or Release), meaning the application fails to correctly close, release, or clean up a resource when processing certain argument values passed to the add_review, save_review, or get_all_reviews functions. This can manifest as file handle exhaustion, unclosed database connections, or unhandled exceptions that crash the process. The CPE string cpe:2.3:a:sourcecodester:customer_review_app:*:*:*:*:*:*:*:* covers all versions with no upper bound fixed version recorded, consistent with the absence of a vendor-released patch in the reference data.
RemediationAI
No vendor-released patch has been identified at time of analysis; the CPE version field remains a wildcard with no fixed-version record in the NVD or VulDB data. Organizations relying on this application should implement input validation and length-limiting controls on the name and comment arguments within add_review, save_review, and get_all_reviews in review_app.py - specifically rejecting null, excessively long, or specially formatted strings before they reach resource-handling logic. As a compensating control, restrict execution of the application to the minimum required local user accounts and monitor for repeated invocation anomalies. Because the attack is local, enforcing least-privilege OS-level access (e.g., dedicated service accounts with no shell access for other users) limits the pool of potential exploiters. Check VulDB entry https://vuldb.com/vuln/367588 and the SourceCodester site https://www.sourcecodester.com/ for future patch releases.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today