EUVD-2026-64854
GHSA-wh8j-46p9-85gg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; low privileges required; scope unchanged; only availability is impacted via infinite loop resource exhaustion.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Infinite loop denial-of-service in bytebot 0.0.1's Agent Execution Workflow can be triggered remotely by a low-privileged attacker, exhausting server resources and disrupting service availability. The product is end-of-life and no longer maintained by bytebot-ai, meaning no official patch will be released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privilege authentication (PR:L per the CVSS 4.0 vector), meaning the attacker must hold a valid account or session credential for the bytebot instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (medium) reflects a network-accessible, low-complexity flaw with limited availability impact and no confidentiality or integrity exposure, which is broadly consistent with the DoS-only nature of an infinite loop. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged authenticated user sends a specially crafted request to the bytebot Agent Execution Workflow endpoint, supplying input designed to trigger an unbounded execution loop. The agent runtime enters an infinite loop, consuming CPU and/or memory until the process is killed or the host becomes unresponsive, denying service to all other users. … |
| Remediation | No vendor-released patch has been identified at time of analysis, and none is expected given the product's end-of-life status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today