What is the CVSS score of CVE-2026-38637?

CVE-2026-38637 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of N A are affected by CVE-2026-38637?

relibc, the C standard library for Redox OS, contains a denial-of-service vulnerability affecting the pthread_rwlockattr_setpshared() function that can exhaust system resources and crash systems.

Is there a public PoC exploit available for CVE-2026-38637?

Yes, a public proof-of-concept exploit is available for CVE-2026-38637. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-38637?

Within 24 hours, conduct an inventory scan to identify any systems running Redox OS and assess whether relibc is in use within the organization. Within 7 days, if Redox OS is deployed, apply input validation controls to applications using pthread library functions, implement rate limiting on resource-intensive operations, and segregate affected systems through containerization or sandboxing to bound denial-of-service impact. Within 30 days, establish continuous monitoring for relibc security updates and Redox project advisories, and engage with the Redox community for patch release timelines.

N A CVE-2026-38637

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-25 mitre

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:17 vuln.today

CVE Published

Jun 25, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 25, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to exhaust availability by passing crafted input to the pthread_rwlockattr_setpshared() function, classified as uncontrolled resource consumption (CWE-400). Publicly available exploit code exists (Marsman1996 PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.17% (6th percentile). The reported CVSS 3.1 vector (7.5, AV:N) appears inconsistent with the local nature of a libc threading API and should be treated cautiously.