Travisun Opptrix EUVD-2026-109309

Exploitation targets the /api/channels/webhook/ endpoint, specifically the preParsing handler's use of Buffer.concat; the CVSS vector (AV:N/PR:N/UI:N) indicates it is reachable remotely with no authentication and no user interaction against the webhook route. The precise manipulation required to trigger the denial of service is not described in the available sources. Key limiting factors sharply reduce realistic exposure: the maintainer states the flaw manifested primarily in local environments during early development, the main versions were intended to run exclusively on localhost, the project has been completely taken offline and deprecated, and a fix was already pushed to the (now private) GitHub repository - so no supported, network-exposed deployment is expected to exist.

The CVSS 4.0 score of 6.9 (medium) reflects an easy-to-reach network vector (AV:N/AC:L/AT:N/PR:N/UI:N) but a deliberately narrow impact: only availability is affected at Low (VA:L), with no confidentiality or integrity consequence (VC:N/VI:N) - consistent with CWE-404 resource mishandling causing denial of service. The input supplies no EPSS score and no KEV listing, so there is no signal of active or widespread exploitation; exploit maturity is E:P (proof-of-concept), and the PoC is a reference link only, not verified as working exploit code. These signals are internally consistent - a reachable-but-low-impact DoS with a priority of this_month rather than act_now/emergency. The decisive mitigating factor overrides the raw network vector: the maintainer states the project was a small learning-scope effort intended to run exclusively on localhost, has been completely taken offline and deprecated, and the fix was already pushed privately. In practice this is a high-reachability-but-low-real-risk issue: the attack surface theoretically exists over the network, but the product's retirement and near-zero production footprint make genuine exposure minimal. EPSS and KEV data are absent (not erroneous); treat the exploitation probability as unestablished rather than low-confirmed.

A remote attacker sends a crafted request to the /api/channels/webhook/ endpoint, where the preParsing handler's use of Buffer.concat mishandles the incoming data and exhausts or corrupts a resource, rendering the service unavailable. A public PoC reference exists (a Google Drive link) but is not verified as working exploit code, and the exact manipulation that triggers the fault is not described in the available sources. Because the product was intended to run only on localhost and is now deprecated and offline, realistic reachability is very limited.