EUVD-2026-23933Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS:
- 7.0.X
- 8.0.X
- 2023.X
- 2024.X
- 2025.X
- 2026.X before 2026.3.X
AnalysisAI
Uncontrolled resource consumption in OTRS admin interface SQL Box causes denial of service against the webserver, affecting OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.3. The vulnerability requires high-privilege admin access and user interaction, limiting real-world impact to authenticated administrators performing deliberate actions. No public exploit code or active exploitation has been identified.
Technical ContextAI
The SQL Box feature in OTRS admin interface implements a query execution mechanism vulnerable to resource exhaustion (CWE-400: Uncontrolled Resource Consumption). This administrative tool, intended for system maintenance tasks, lacks proper input validation or execution resource limits on SQL queries executed through the web interface. The vulnerability allows a malicious admin to craft SQL statements that consume excessive CPU, memory, or I/O resources on the webserver, causing performance degradation or service unavailability. The CPE cpe:2.3:a:otrs_ag:otrs:*:*:*:*:*:*:*:* indicates the entire OTRS product line is affected across all architectures and implementations.
RemediationAI
Upgrade OTRS to version 2026.3 or later to resolve the SQL Box resource consumption issue. For administrators unable to immediately upgrade, implement access control restrictions on the admin interface by limiting SQL Box feature access to a minimal set of trusted administrators, or disable the SQL Box feature entirely if not required for operational maintenance. Monitor webserver process resource utilization (CPU, memory) and establish alerts for anomalous consumption patterns that may indicate exploitation attempts. The vendor advisory at https://otrs.com/release-notes/otrs-security-advisory-2026-01/ provides additional context and should be reviewed before patching to ensure compatibility with local customizations.
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.2
In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenti
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm,
Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS]
Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via Tic
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Op
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x befor
Unauthenticated SQL injection in OTRS and the legacy ((OTRS)) Community Edition database layer enables authentication by
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS base
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with
Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today