EUVD-2026-85307
GHSA-p97r-9rrc-gr9r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Console commands are sent over the network (AV:N) by an already-authorized user (PR:L), needing no special timing (AC:L); impact is a DoS only, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.
AnalysisAI
Denial of service in Robur Albatross (specifically the albatross-console component) versions 1.0.0 through 2.x before 2.7.2 lets an authenticated user who can send console subscription commands drive the albatross-console process into an unterminated loop over the unikernel log ring buffer, consuming CPU and making console access unavailable. Exploitation requires the targeted unikernel to have generated enough output to fill the 1024-line ring buffer, and the request must specify a very high or negative line count, or a timestamp earlier than every buffered message; the vendor states it is not exploitable by unauthorized clients, and the independent assessment confirms PR:L with availability-only impact (C:N/I:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated/authorized user (PR:L) who can send console subscription commands to albatross-console; the description states it is not exploitable by unauthorized clients. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk, not a high-urgency threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Robur Albatross to 2.7.2 (released 2026-05-29), which contains the bounded ring-buffer traversal fix from PR #273 (https://github.com/robur-coop/albatross/pull/273) and is tracked publicly as OSEC-2026-09 at https://osv.dev/vulnerability/OSEC-2026-09. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of albatross-console in the 1.0.0 through 2.x range, restrict console subscription command privileges to the smallest possible set of trusted operators, and confirm least-privilege enforcement consistent with the CVSS PR:L (authenticated) requirement; add monitoring and alerting on sustained CPU saturation or unresponsive/hung albatross-console processes and ensure operators know the restart procedure to restore console access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with rais
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow a
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow w
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but wi
Heap memory corruption in the OCaml runtime (before 4.14.3 and 5.x before 5.4.1) lets an attacker who can feed crafted M
Arbitrary file write in OCaml opam before 2.5.1 allows a malicious package to escape its intended installation scope: a
Remote denial of service in the utcp OCaml TCP userspace library before version 0.0.6 is possible via crafted out-of-ord
Index mishandling in the OCaml cstruct library before 6.3.0 allows network-reachable attackers to trigger partial confid
ECDSA signature forgery is possible in mirage-crypto-ec before 2.2.0 for OCaml because the P256, P384, and P521 pub_of_o
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writ
Timing side-channel in mirage-crypto-ec before 2.4.0 for OCaml enables remote cryptographic key recovery by exploiting s
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today