Skip to main content

NetApp StorageGRID CVE-2026-22056

| EUVDEUVD-2026-67963 LOW
Allocation of File Descriptors or Handles Without Limits or Throttling (CWE-774)
2026-08-28 netapp GHSA-5wch-3wjh-6fhj
Denial Of Service Storagegrid Netapp
2.3
CVSS 4.0 · Vendor: netapp

Severity by source

Vendor (netapp) PRIMARY
2.3 LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.1 LOW

Network-reachable but high complexity and authenticated (PR:L) with partial availability impact only; no confidentiality, integrity, or scope-change effects apply.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (netapp).

CVSS VectorVendor: netapp

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 28, 2026 - 22:40 vuln.today

DescriptionCVE.org

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.

AnalysisAI

Partial Denial of Service in NetApp StorageGRID versions 11.5 and higher arises from unbounded resource allocation (CWE-774) reachable only under a non-standard configuration and specific operational scenario. An authenticated network attacker with some degree of environmental control can exhaust handles or descriptors to degrade availability, though impact is explicitly partial and limited to the vulnerable system. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation is gated on two explicit conditions stated by the vendor: StorageGRID must be version 11.5 or higher, and the system must be operating in a non-standard configuration under a specific scenario - standard deployments are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The overall risk is genuinely low and difficult to prioritize above routine maintenance for most operators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult the NetApp security advisory at https://security.netapp.com/advisory/NTAP-20260828-0021/ to obtain the specific patched version, as no exact fix version is confirmed in the available data - only a vendor patch advisory reference is provided. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Storagegrid

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2016-3427 CRITICAL
9.8 Apr 21

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows rem
CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
CVE-2017-7668 HIGH
7.5 Jun 20

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
CVE-2022-37434 CRITICAL POC
9.8 Aug 05

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
CVE-2025-25291 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
CVE-2025-25292 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2017-3167 CRITICAL
9.8 Jun 20

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules ou
CVE-2021-39275 CRITICAL
9.8 Sep 16

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. Rated critical severity (CVSS 9.8),

CVE-2018-1312 CRITICAL
9.8 Mar 26

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent repl
CVE-2020-14664 HIGH
8.3 Jul 15

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). Rated high severity (CVSS 8.3), this vulnera

Same weakness CWE-774 – Allocation of File Descriptors or Handles Without Limits or Throttling

View all
CVE-2018-1000538 HIGH
7.5
CVE-2024-48848 HIGH
7.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-22056 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy