EUVD-2026-25424Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow component
AnalysisAI
Denial of service in Hostbill versions 2025-11-24 and 2025-12-01 allows remote unauthenticated attackers to degrade service availability through the Checkout Authentication Flow component via uncontrolled resource consumption (likely improper rate limiting). The vulnerability has a low-to-moderate CVSS score (5.3) reflecting limited impact scope, but exploitation requires no authentication or user interaction and can be triggered over the network.
Technical ContextAI
The vulnerability resides in Hostbill's Checkout Authentication Flow component and is classified as CWE-400 (Uncontrolled Resource Consumption). This CWE category typically encompasses improper rate limiting, resource exhaustion, or denial of service conditions triggered by excessive requests or resource allocation within a specific code path. The affected component is part of the payment checkout process, which is typically exposed to unauthenticated users during transaction initiation. The GitHub reference to 'Rate Limit Bypass' in the disclosure repository suggests the root cause is insufficient or absent rate limiting controls on the authentication endpoint.
RemediationAI
Upgrade Hostbill to the patched version released after 2025-12-01; consult https://hostbillapp.com/release-notes/ or the vendor security advisory at https://blog.hostbillapp.com/2025/12/03/hostbill-security-advisory/ for the exact fixed version number. As a compensating control pending upgrade, implement rate limiting at the reverse proxy or load balancer level targeting the Checkout Authentication Flow endpoint (typically /checkout/auth or similar) to restrict requests per IP address to a reasonable threshold (e.g., 10 requests per minute per source IP). Monitor checkout logs for spike patterns indicating resource exhaustion attempts. If the vendor advisory specifies a particular query parameter or request characteristic triggering the issue, implement WAF rules to block malformed requests to the affected endpoint. Note that external rate limiting does not address the underlying code defect and should be treated as temporary; vendor patch application is the permanent fix.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today