EUVD-2026-63666Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable published port, no authentication required, no user interaction; impact is exclusively host memory exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete - with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
AnalysisAI
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target container has at least one TCP port published and reachable by the attacker - containers with no published ports are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the network-reachable, unauthenticated, low-complexity nature of this DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apple container version 1.2.0 or later, which is the vendor-released patch addressing this vulnerability per the advisory at https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Apple container runtime versions prior to 1.2.0, prioritizing those with container ports exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local atta
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to requ
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today