EUVD-2026-44923
GHSA-c4fr-5qh5-c6fh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DFXAnalytics endpoint
-
DeliveryCraft oversized input field
-
ExploitOverflow fixed-size stack buffer (CWE-121)
-
ExecutionCrash or hang service process
-
ImpactDenial of service for users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against reachable instances of HCL DFXAnalytics 3.0 and below, since the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U (no authentication, no user interaction, low complexity). The concrete prerequisite is network reachability to the DFXAnalytics service and the ability to submit an input field whose length exceeds the vulnerable fixed-size buffer, because the application fails to enforce input-length checks on the server side. Limiting factors: the impact is confined to denial of service (C:N/I:N/A:H - no data disclosure or code execution per the provided data), and exposure depends on whether the service is internet-facing versus segmented behind a firewall/VPN; instances restricted to trusted networks are far less reachable. |
| Impact | The signals are internally consistent and point to a moderate, availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remotely reachable, low-complexity, unauthenticated crash with no confidentiality or integrity impact - the 7.5 is driven entirely by high availability impact. CISA SSVC aligns with this: Exploitation 'none' (no observed exploitation), Automatable 'yes' (the trigger is scriptable and needs no user interaction), and Technical Impact 'partial' (a crash, not full compromise). EPSS is low at 0.24% (15th percentile), and there is no KEV listing and no public exploit identified, so this is not currently a widespread-exploitation priority. The main caveat is that CWE-121 stack overflows can sometimes be escalated beyond DoS, but nothing in the provided data (C:N/I:N) supports code execution here - treat it as a DoS. Prioritize based on how exposed and business-critical the DFXAnalytics instance is rather than on the raw 7.5 alone. |
| Exploit ScenarioDerived | A remote attacker with network access to the DFXAnalytics endpoint sends a single crafted request containing an oversized field that exceeds the target buffer's capacity, overrunning the stack buffer and crashing the process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed and the request is trivial to script and repeat, taking the service offline for its users. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 17, 2026
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Earlier versions of this analysis (1)
Stack-based buffer overflow in HCL DFXAnalytics allows remote unauthenticated attackers to crash or render the application unresponsive by submitting excessively large input values that bypass missing server-side length validation. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium) with availability as the sole impact dimension - no confidentiality or integrity exposure is present, and remote code execution has not been indicated. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Upgrade to a fixed release of HCL DFXAnalytics above version 3.0 as directed by the HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787; no exact patched version number is stated in the available data, so consult that knowledge-base article (KB0131787) for the specific fixed build. Patch status: Patch available per vendor advisory. Until the update is applied, restrict network reachability to the DFXAnalytics service - place it behind a VPN or firewall so only trusted hosts can reach it, and where a reverse proxy or WAF fronts the application, enforce request/field size limits to reject oversized payloads before they reach the vulnerable parser (trade-off: aggressive size caps can truncate legitimate large analytics inputs, so tune limits against normal payload sizes). Because the flaw is availability-only, also ensure the service auto-restarts via a process supervisor with health checks to limit outage duration if a crash is triggered.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is HCL DFXAnalytics (CPE cpe:2.3:a:hcl_software:dfxanalytics), an HCL Software analytics application. The root cause is CWE-121 (Stack-based Buffer Overflow): the application copies attacker-supplied data into a stack-allocated, fixed-size buffer without first checking that the input length fits, so an excessively large value overruns the container. Per the vendor description the missing safeguard is a length check on both client and server sides, indicating the server-side parser trusts input sizes rather than bounding them before the copy. Because the corrupted memory here manifests as a crash rather than controlled code flow, the practical consequence is process termination or hang rather than code execution.
Know when Dfxanalytics gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable, low-complexity, unauthenticated crash with no user interaction (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.
Executive ViewAI
HCL DFXAnalytics versions 3.0 and below are vulnerable to a remotely exploitable denial-of-service attack requiring no authentication. Attackers can crash or hang the application via oversized input, potentially disrupting analytics operations and dependent reporting workflows.
Deploy WAF or firewall rules to block requests exceeding typical payload sizes for DFXAnalytics; configure rate-limiting per source IP to mitigate rapid attack attempts; restrict network access to the application from untrusted or external networks; implement verbose request logging and alerting for detection of oversized inputs or application hangs; isolate DFXAnalytics on a network segment with limited egress to reduce lateral movement risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Dfxanalytics
View allHCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Securi
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authent
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
Exploit-DB