EUVD-2026-32499
GHSA-fqw5-w9px-94f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach asperahttpd listener over network
-
DeliverySend crafted HTTP request
-
ExploitTrigger NULL pointer dereference
-
ExecutionCrash asperahttpd service
-
ImpactDeny file-transfer availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the asperahttpd HTTP daemon of an affected IBM Aspera High-Speed Transfer Endpoint or Server (3.7.4 through 4.4.7 Fix Pack 1); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed. The primary limiting factor is exposure: the asperahttpd listener must be reachable by the attacker, so deployments that firewall the HTTP/HTTPS port off from untrusted networks, or that do not expose the asperahttpd service, are not practically reachable. The impact is confined to availability (A:H, C:N/I:N) - the attacker can crash the service but cannot read data or run code through this flaw. |
| Impact | The CVSS 3.1 base score is 7.5 driven entirely by the availability dimension (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): network-reachable, low attack complexity, no privileges, no user interaction, but impact limited to availability only - there is no code execution or data exposure. This profile is internally consistent - a remotely triggerable crash - so the CVSS vector and the description agree (unauthenticated network DoS). No EPSS score was provided in the input, so exploitation probability cannot be quantified, and no SSVC decision data (exploitation/automatable/technical-impact) was supplied. The CVE is not on CISA KEV and no POC is referenced, so this is a high-CVSS availability bug rather than a confirmed-exploited priority; realistic urgency depends on whether asperahttpd is exposed to untrusted networks. A single crash may be recoverable via service restart, but if the fault is trivially repeatable it constitutes a durable DoS. |
| Exploit ScenarioDerived | An attacker with network reachability to the asperahttpd listener sends a crafted HTTP request that triggers the NULL pointer dereference, causing the daemon to fault and terminate without any login or user interaction. Repeating the request keeps the file-transfer service offline, disrupting business-critical high-speed transfers. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Remote denial of service in IBM Aspera High-Speed Transfer Endpoint and High-Speed Transfer Server (versions 3.7.4 through 4.4.7 Fix Pack 1) allows an unauthenticated network attacker to crash the asperahttpd service via a NULL pointer dereference. Exploitation requires no credentials and no user interaction, yielding a complete loss of availability for the affected transfer service. There is no public exploit identified at time of analysis, and the issue has no confidentiality or integrity impact.
RemediationAI
Apply the fix described in the IBM advisory at https://www.ibm.com/support/pages/node/7273615; the provided data does not include an exact fixed version number, so administrators should consult that advisory for the specific Fix Pack/release that supersedes 4.4.7 Fix Pack 1 and verify it before deploying. Until patched, reduce exposure of the asperahttpd HTTP listener: restrict access to the asperahttpd port to trusted source networks via firewall or ACLs, place the service behind a reverse proxy or VPN, and disable the HTTP/HTTPS fallback transfer path if it is not required in your deployment (trade-off: clients that rely on HTTP fallback or web-based transfer setup will lose that capability and may fail behind restrictive firewalls). Because the impact is a crash, also configure service auto-restart/monitoring so the daemon recovers quickly, while recognizing this does not prevent repeated re-triggering by an attacker.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Aspera is a high-speed managed file transfer suite built on the FASP protocol; the affected piece is asperahttpd, the embedded HTTP daemon that fronts the High-Speed Transfer Server/Endpoint (typically used for HTTP/HTTPS fallback and web-based transfer setup). The root cause is classified as CWE-476 (NULL Pointer Dereference), meaning the daemon dereferences a pointer that was never initialized or had been set to NULL - most plausibly while parsing an attacker-supplied request - causing the process to fault and terminate. Because asperahttpd is a network-facing listener, the defect is reachable directly over the network without any authenticated session. No CPE strings were supplied in the input; affected product identification therefore relies on the NVD/EUVD version ranges rather than machine-readable CPE entries.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential denial of service in the asperahttpd component. An unauthenticated user can cause the asperahttpd service to crash.
Executive ViewAI
IBM Aspera High-Speed Transfer service (versions 3.7.4-4.4.7 Fix Pack 1) is vulnerable to unauthenticated remote denial of service, allowing attackers to crash the asperahttpd service without requiring credentials or user interaction. Organizations dependent on Aspera for mission-critical data transfers face service disruption; no public exploit identified at time of analysis, but the low technical barrier to exploitation presents a material operational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict asperahttpd network access via firewall rules, deploy connection rate limiting and session timeout policies, enable service crash monitoring with automated alerting, and document rapid service restart procedures. Coordinate with IBM support to confirm patched release availability and upgrade feasibility.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB