Hostbill CVE-2026-31051

Apply the patched version released after 2025-12-01 as documented in the Hostbill security advisory at https://blog.hostbillapp.com/2025/12/03/hostbill-security-advisory/. The exact fix version is not specified in available data; contact Hostbill support or consult their release notes for the current patched build. Until patching is feasible, implement the following compensating controls: (1) Restrict administrator access to the Client Balance component via role-based access control (RBAC) - limit admin privileges to only necessary users and segregate billing administration from general system administration; this reduces the attack surface by minimizing high-privilege accounts. (2) Monitor Client Balance API and component access logs for anomalous resource consumption patterns, such as repeated rapid requests or unusually large batch operations that may indicate exploitation attempts. (3) Implement rate limiting on Client Balance endpoints at the reverse proxy or API gateway layer to prevent resource exhaustion, with trade-off of potential blocking of legitimate bulk operations. (4) Disable or restrict access to the Client Balance component from untrusted networks, leaving it accessible only from internal staff or whitelisted IPs. Note that these controls do not eliminate the vulnerability but reduce feasibility and detectability of attacks. Patch as soon as available.