EUVD-2026-35974
GHSA-mmg8-4hr2-cpxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (qnap) · only source for this CVE.
CVSS VectorVendor: qnap
Lifecycle Timeline
6DescriptionCVE.org
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
AnalysisAI
Resource exhaustion in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5242) allows a remote attacker holding a low-privilege user account to exhaust shared resources, denying availability to other users, processes, or applications on the same system. The vulnerability is classified as a Denial-of-Service risk with no impact on confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis; QNAP has released a patched version and published a security advisory.
Technical ContextAI
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), a class of vulnerability where an application fails to impose caps on how much of a shared resource - such as file handles, memory, connections, or processing threads - a single user or session can consume. In QNAP File Station 5, the affected component (CPE: cpe:2.3:a:qnap_systems_inc.:file_station_5:*:*:*:*:*:*:*:*) provides web-based file management on QNAP NAS devices. An authenticated user can craft requests that drive unbounded resource consumption, starving other processes or users of that resource type. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is fully network-reachable, requires no complex preconditions, and demands only low-level credentials - consistent with a standard NAS user account.
RemediationAI
The primary fix is to upgrade QNAP File Station 5 to version 5.5.6.5243 or later, as confirmed by QNAP's security advisory QSA-26-26 (https://www.qnap.com/en/security-advisory/qsa-26-26). Updates can typically be applied through the QNAP App Center on the NAS management interface. If immediate patching is not possible, the most effective compensating control is to restrict which accounts have access to File Station - removing or disabling non-essential user accounts reduces the pool of potential attackers, since PR:L authentication is a hard prerequisite for exploitation. Additionally, network-level access controls (firewall rules, VPN-only access) can limit who can reach the File Station service, though this does not eliminate the vulnerability for authorized users. There are no known workarounds that remove the resource-throttling gap itself without the vendor patch.
More in File Station 5
View allStack-based buffer overflow in QNAP File Station 5 versions 5.5.0 through 5.5.6.5208 allows authenticated remote attacke
Authorization bypass in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5243) allows a remote attacker with a valid lo
NULL pointer dereference in QNAP File Station 5 enables authenticated remote attackers to crash the service and cause a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today