Velneo vServer CVE-2026-114405

No special configuration conditions are stated in the description - exploitation targets a Velneo vServer instance reachable over the network, with the CVSS vector (AV:N/PR:N/UI:N) indicating no authentication or user interaction is required. The practical limiting factors are: the vServer service must be network-exposed to the attacker, the instance must run an affected build (36.0 before 36.6, or 37.0 before 37.2), and the achievable outcome is confined to denial of service (VA:H) - there is no path to data disclosure or code execution from this flaw alone. Deployment of the patched release eliminates the condition.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no authentication or user interaction, which would normally mark it as a high priority. However, the impact profile is narrow: the vector sets VC:N/VI:N/VA:H, meaning the only consequence is loss of availability (denial of service) with no confidentiality or integrity impact, and no scope change (SC/SI/SA:N). This is consistent with CWE-129 (improper validation of array index), which in a server context typically causes an out-of-bounds access that crashes or hangs the process rather than leaking or corrupting data. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent exploitation. NOTE A CONFLICT: the input Tags include 'Information Disclosure', but the CVSS vector explicitly rates confidentiality impact as VC:N - the two signals disagree, and the availability-only vector should be treated as authoritative unless the vendor advisory states otherwise. Net assessment: a genuine remote, unauthenticated DoS worth patching, but not a data-breach or RCE-class emergency; absent EPSS/KEV/POC signals, real-world exploitation pressure appears low.

A remote, unauthenticated attacker sends a crafted request to an exposed Velneo vServer instance containing an index value that the server fails to validate against array bounds. The resulting out-of-bounds access crashes or destabilizes the server process, interrupting service for all connected clients. No public proof-of-concept is known, and the flaw yields only denial of service, not code execution or data access.