NonStop HTTP WEBSERVER EUVD-2026-101999

Exploitation requires network reachability to an HPE NonStop HTTP WEBSERVER instance that accepts HTTP requests; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, or user interaction are needed against a listening server. The description provides no feature-flag, configuration, or deployment-mode precondition - the only concrete prerequisite is that the NonStop HTTP WEBSERVER component is deployed and network-accessible to the attacker. The principal limiting factor is the narrow deployment base of the HPE NonStop platform itself rather than any special configuration; the realistic worst-case outcome is a system halt (availability loss), not code execution or data compromise.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, which on its face is attractive to attackers. However, the impact profile is skewed toward availability (A:H) with only low integrity impact (I:L) and no confidentiality impact (C:N) - this is fundamentally a denial-of-service/system-halt condition (CWE-20 improper input validation leading to memory corruption), not a code-execution or data-theft bug, which is why the base score lands at 8.2 rather than critical. No EPSS score, SSVC decision data, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is further moderated by the target: HPE NonStop is a specialized, limited-footprint fault-tolerant platform, so this is best treated as a priority for the specific organizations running NonStop HTTP WEBSERVER rather than a broadly exploited internet-wide threat. Note the tension between the network vector and the availability-only impact - an attacker gains no foothold, only the ability to halt the system - so prioritization should weight the business criticality of affected NonStop deployments over the raw CVSS number.

A remote, unauthenticated attacker sends a specially crafted HTTP request to an internet- or network-reachable HPE NonStop HTTP WEBSERVER instance, triggering memory corruption due to improper input validation. The malformed input corrupts memory in the request-handling path, causing the webserver or the underlying system to halt, resulting in a denial of service. No public exploit code is identified in the available data.