What is the CVSS score of CVE-2026-27482?

CVE-2026-27482 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of DNS are affected by CVE-2026-27482?

Organizations using Ray should be aware of moderate risk from CVE-2026-27482 rated CVSS 5.9. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27482?

Yes, a public proof-of-concept exploit is available for CVE-2026-27482. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27482?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

DNS CVE-2026-27482

MEDIUM

Declaration of Catch for Generic Exception (CWE-396)

2026-02-21 security-advisories@github.com

GHSA-q5fh-2hc8-f6rq

DNS AI / ML Ray

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Mar 04, 2026 - 18:59 vuln.today

Public exploit code

Patch released

Mar 04, 2026 - 18:59 nvd

Patch available

CVE Published

Feb 21, 2026 - 10:16 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on ray (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.54.0.

DescriptionGitHub Advisory

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.

AnalysisAI

Ray dashboard versions 2.53.0 and below lack proper authentication on DELETE endpoints, allowing unauthenticated attackers to terminate Serve instances or remove jobs through DNS rebinding or same-network attacks. Public exploit code exists for this vulnerability, which impacts Ray deployments with dashboards exposed to network access. Administrators should upgrade to Ray 2.54.0 or higher to remediate the availability risk.

Technical ContextAI

Affects Ray. Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in DNS

View all

CVE-2026-24054 CRITICAL Act Now POC

10.0 Jan 29

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g

CVE-2019-25361 CRITICAL Act Now POC

9.8 Feb 18

Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code

CVE-2019-25327 CRITICAL Act Now POC

9.8 Feb 12

Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.

CVE-2019-25319 CRITICAL Act Now POC

9.8 Feb 12

Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.

CVE-2020-37095 CRITICAL Act Now POC

9.8 Feb 07

Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the netwo

CVE-2021-47774 CRITICAL Act Now POC

9.8 Jan 15

Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.

CVE-2021-47785 CRITICAL Act Now POC

9.8 Jan 16

Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av

CVE-2019-25362 CRITICAL Act Now POC

9.8 Feb 18

Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.

CVE-2020-37119 CRITICAL Act Now POC

9.8 Feb 05

Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker

CVE-2026-1678 CRITICAL Act Now POC

9.4 Mar 05

Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.

CVE-2026-2186 HIGH This Week POC

8.8 Feb 08

Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst

CVE-2026-3379 HIGH This Week POC

8.8 Mar 01

Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows

Same weakness CWE-396 – Declaration of Catch for Generic Exception