EUVD-2026-100941
GHSA-f22h-g445-7rgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed iTP WebServer over network
-
DeliverySend crafted malformed request
-
ExploitTrigger input-validation memory corruption
-
ExecutionServer process crashes/shuts down
-
ImpactDenial of service on NonStop host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | No special configuration conditions are stated in the description - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation against a reachable HPE NonStop iTP WebServer, with no authentication, user interaction, or documented non-default feature requirement. The primary LIMITING factor is exposure and footprint: the iTP WebServer must be network-reachable by the attacker, and the affected software runs only on the niche HPE NonStop platform rather than general-purpose servers, substantially narrowing the realistic attack surface. The concrete prerequisite details (exact vulnerable versions and the specific malformed input) are not in the description and should be confirmed from HPE advisory hpesbns05148en_us. |
| Impact | This is a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication or user interaction, which is what drives the 8.2 score - but the impact profile is lopsided: C:N (no confidentiality loss), I:L (limited integrity impact from memory corruption), and A:H (full availability loss via system shutdown). In practice this is primarily a remote denial-of-service/crash vulnerability rather than a confidentiality or full-takeover issue, despite the 'memory corruption' language that superficially suggests code-execution potential - the CVSS does NOT reflect integrity-complete or code-execution impact (I:L, not I:H), so claims of RCE are not supported by the provided data and should be verified with HPE. No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the input; absence of these means exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The combination of easy remote reachability but a niche, non-internet-ubiquitous platform (HPE NonStop) means real-world risk is moderate: dangerous to the specific high-availability environments that run NonStop, but not a broad internet-wide threat. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request over the network to an exposed HPE NonStop iTP WebServer instance, triggering improper input validation that corrupts memory and forces the server (or host process) to shut down, causing a denial of service. No authentication or user interaction is required (PR:N/UI:N), making the attack trivial to launch against any reachable instance. No public exploit code has been identified at time of analysis, so exploitation would currently require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote, unauthenticated requests to HPE NonStop iTP WebServer can trigger memory corruption severe enough to shut the service and system down, giving network-positioned attackers a reliable denial-of-service with a secondary integrity impact. The assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, CVSS 8.2) shows no authentication, user interaction, or non-default feature is required - the only real barrier is that the target web server must be network-reachable, and it runs solely on the niche HPE NonStop platform rather than commodity servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied; combined with the narrow platform footprint, this is a genuine but bounded priority rather than a mass-exploitation threat.
RemediationAI
Apply the HPE-supplied fix for NonStop iTP WebServer as documented in security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US); the advisory is authoritative for the exact corrected iTP WebServer build and NonStop RVU, and no specific fix version is confirmed in the provided data, so no version number should be assumed. Because the flaw is remotely triggerable without authentication, the most effective immediate compensating control is to stop exposing iTP WebServer to untrusted networks: bind it to internal interfaces only and restrict TCP access to the serving port via NonStop IP filtering, firewall ACLs, or host-based rules limited to known management hosts - accepting that this blocks legitimate remote users until patching is complete. Where the service must remain externally reachable, front it with a reverse proxy or WAF that enforces strict request-size, header-length, and URL-shape limits and drops malformed HTTP input; the trade-off is that generic signatures may not match the specific malformed input this flaw requires, so this is a partial mitigation only. If iTP WebServer is not actively required for management or application traffic, disabling it and using an alternative access path removes the attack surface entirely, at the cost of losing whatever administrative or integration function it currently provides. Monitor NonStop event logs for unexpected web server aborts and system shutdown events as a detection signal for exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-20 (Improper Input Validation) and tagged as a buffer overflow, indicating that malformed input delivered to the iTP WebServer is not correctly validated or bounds-checked before being processed, allowing memory to be corrupted. iTP WebServer is a legacy HTTP/web-serving component that ships on HPE NonStop (formerly Tandem) fault-tolerant systems, typically used for management interfaces, lightweight application front-ends, and integration endpoints on those machines. The CVSS vector is strongly availability-weighted (C:N/I:L/A:H with S:U), which is consistent with memory corruption that primarily crashes or halts the service but can also produce limited unauthorized modification of data or memory state; there is no evidence in the available data of confidentiality loss such as memory disclosure or code execution. The supplied CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_itp_webserver:*:*:*:*:*:*:*:* uses a wildcard version, so the precise set of vulnerable builds is not enumerated in the intelligence feed and must be established from the HPE security bulletin.
Know when Hpe Nonstop Itp Webserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Remote unauthenticated low-complexity trigger (AV:N/AC:L/PR:N/UI:N); impact is availability-dominant system shutdown (A:H) with limited integrity from memory corruption (I:L) and no confidentiality loss.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
Executive ViewAI
HPE NonStop iTP WebServer, the web front end that many financial, payments, and telecommunications operators run on NonStop systems for core transaction processing, can be shut down along with the underlying system by a single unauthenticated network request. Exposure is limited to organizations that actually run this web server on the niche NonStop platform, so this is not a broad enterprise threat, but for those affected the failure mode is a full outage of business-critical transaction systems rather than a contained web-service restart. No vendor patch is available and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a bounded but genuine availability risk that warrants targeted exposure reduction.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of iTP WebServer to trusted source addresses only via firewall or ACL rules; front the service with a reverse proxy, load balancer, or WAF enforcing request validation and rate limiting; isolate affected instances in a segmented zone with no inbound path from user or partner networks; enable availability and crash alerting with defined restart and failover procedures; reduce the number of exposed instances by decommissioning or consolidating non-essential deployments; and engage HPE support for a hotfix or mitigation guidance until a supported patch is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB