EUVD-2026-44923
GHSA-c4fr-5qh5-c6fh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable, low-complexity, unauthenticated crash with no user interaction (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.
AnalysisAI
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Technical ContextAI
The affected component is HCL DFXAnalytics (CPE cpe:2.3:a:hcl_software:dfxanalytics), an HCL Software analytics application. The root cause is CWE-121 (Stack-based Buffer Overflow): the application copies attacker-supplied data into a stack-allocated, fixed-size buffer without first checking that the input length fits, so an excessively large value overruns the container. Per the vendor description the missing safeguard is a length check on both client and server sides, indicating the server-side parser trusts input sizes rather than bounding them before the copy. Because the corrupted memory here manifests as a crash rather than controlled code flow, the practical consequence is process termination or hang rather than code execution.
RemediationAI
Upgrade to a fixed release of HCL DFXAnalytics above version 3.0 as directed by the HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787; no exact patched version number is stated in the available data, so consult that knowledge-base article (KB0131787) for the specific fixed build. Patch status: Patch available per vendor advisory. Until the update is applied, restrict network reachability to the DFXAnalytics service - place it behind a VPN or firewall so only trusted hosts can reach it, and where a reverse proxy or WAF fronts the application, enforce request/field size limits to reject oversized payloads before they reach the vulnerable parser (trade-off: aggressive size caps can truncate legitimate large analytics inputs, so tune limits against normal payload sizes). Because the flaw is availability-only, also ensure the service auto-restarts via a process supervisor with health checks to limit outage duration if a crash is triggered.
More in Dfxanalytics
View allCleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today