Cloudburst Network CVE-2026-45291

No special conditions - remote unauthenticated exploitation against any publicly accessible application that depends on a vulnerable version (prior to 1.0.0.CR3-20260418.124334-32) of the CloudburstMC Network library, consistent with the AV:N/AC:L/PR:N/UI:N vector. Exploitation is limited to applications that actually expose the affected Netty listener to attacker-reachable networks; instances bound to localhost, restricted to trusted peers by firewall, or already running the fixed version are not exploitable. No user interaction, credentials, or non-default configuration is required.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a low-complexity, network-reachable, unauthenticated availability-only attack - well aligned with a single crafted packet shutting down the listener. There is no EPSS, KEV, or POC signal supplied, so exploitation is assessed as no public exploit identified at time of analysis, and this is not on CISA's KEV list. Despite the lack of public exploit code, the trivial preconditions (publicly reachable listener, no authentication, low complexity) make this a meaningful operational risk for any server exposing the library to the internet, particularly multiplayer Bedrock-style game servers where opportunistic DoS is common. The 'Information Disclosure' tag in the source feed appears inconsistent with the C:N/I:N CVSS vector and the description (which describes only channel closure) - defenders should treat this as an availability issue and verify with the GHSA advisory before assuming any data exposure.

An attacker scans the internet for servers running a Cloudburst-based project on its known UDP/TCP port, then sends a single crafted packet that triggers the input-validation flaw in the Network library. The parent Netty channel closes and the server stops accepting any new or existing connections, denying service to all legitimate users until an operator restarts the process. No public POC is currently identified, but the low attack complexity and lack of authentication make weaponization straightforward.