Skip to main content

Confluence Data Center EUVDEUVD-2026-46327

| CVE-2026-21577 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 atlassian GHSA-2v44-87c2-pxr3
Denial Of Service Atlassian Confluence Data Center
7.1
CVSS 4.0 · Vendor: atlassian
Share

Severity by source

Vendor (atlassian) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (atlassian) · only source for this CVE.

CVSS VectorVendor: atlassian

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 18:01 vuln.today
CVE Published
Jul 21, 2026 - 17:00 cve.org
HIGH 7.1

DescriptionCVE.org

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17

Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Penetration Testing program.

AnalysisAI

Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all Confluence Data Center instances in your environment and identify which are running versions 9.0.x through 10.2.x, documenting critical user dependencies and business functions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Confluence Data Center

View all
CVE-2023-22518 CRITICAL POC
9.8 Oct 31

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit
CVE-2022-26134 CRITICAL POC
9.8 Jun 03

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and
CVE-2022-42978 HIGH POC
7.5 Nov 15

In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. Rated high severity

CVE-2022-42977 HIGH POC
7.5 Nov 15

The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in

CVE-2022-26136 CRITICAL
9.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2021-26085 MEDIUM POC
5.3 Aug 03

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza
CVE-2024-21677 HIGH
8.8 Mar 19

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s
CVE-2024-21673 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center
CVE-2024-21672 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center a
CVE-2023-22522 HIGH
8.8 Dec 06

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u
CVE-2023-22508 HIGH
8.8 Jul 18

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-46327 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy