EUVD-2026-47648Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X
Network-reachable honeypot listener requires no authentication; purely availability impact; the AT:P prerequisite (module enabled) is captured in exploitation conditions rather than inflating AC in 3.1.
Primary rating from Vendor (ThinkstAppliedResearch).
CVSS VectorVendor: ThinkstAppliedResearch
Lifecycle Timeline
1DescriptionCVE.org
Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation.
This issue affects OpenCanary 0.9.8 only.
AnalysisAI
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
Technical ContextAI
OpenCanary is an open-source deception honeypot framework by Thinkst Applied Research (CPE: cpe:2.3:a:thinkst_applied_research:opencanary:*:*:*:*:*:*:*:*) that simulates various services - including MongoDB - to detect attacker reconnaissance. CWE-835 (Loop with Unreachable Exit Condition) describes a code path where a loop's termination condition can never be satisfied, resulting in the process spinning indefinitely. In this context, that loop also performs memory allocation on each iteration, so the combined effect is unbounded memory consumption until the host or process is exhausted. Because honeypot services are architecturally designed to accept connections from untrusted parties without authentication, the attack surface is inherently exposed whenever the MongoDB module is active.
RemediationAI
Consult the vendor security advisory at https://github.com/thinkst/opencanary/security/advisories/GHSA-vg37-pc42-q265 for the patched release and upgrade instructions - no specific fixed version number was included in the available intelligence data, so the upstream advisory is the authoritative source for the target upgrade version. As an interim compensating control, disabling the MongoDB module in the OpenCanary configuration file eliminates the attack surface entirely, at the trade-off of losing MongoDB honeypot sensor coverage. Alternatively, restricting network access to the MongoDB listener port via host-based or perimeter firewall rules reduces exposure to trusted source IPs, though this limits honeypot effectiveness by narrowing which attacker activity is captured. Operators should monitor the Thinkst OpenCanary GitHub repository for a patched release and upgrade as soon as one is available.
More in Opencanary
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today