EUVD-2026-85921
GHSA-99rf-x5r6-q76q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity single-request DoS with no user interaction; only availability is affected (persistent hang), so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.
AnalysisAI
Unauthenticated denial of service in Rejetto HFS2 2.4.0 and earlier lets a remote attacker take the entire file server offline with a single crafted request to the getini handling path, which drives a serving thread into an infinite busy loop that consumes CPU and stops the server answering any client. The failure is persistent and self-perpetuating: there is no timeout or automatic recovery, so availability is only restored when an operator manually restarts the service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Rejetto HFS2 2.4.0 and earlier; a single crafted request to the network-facing HTTP service (the getini handling path per the referenced advisory) is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable availability risk rather than an inflated high-CVSS-but-low-real-risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified in the provided intelligence at time of analysis, so the priority is reducing exposure until a fixed build is published and confirmed - check the VulnCheck advisory (https://www.vulncheck.com/advisories/hfs2-unauthenticated-denial-of-service-via-hung-serving-thread) and the researcher advisory (https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md) for updated fixed-version information before deploying anything. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Rejetto HFS2 instance in the estate and confirm which are running 2.4.0 or earlier, then immediately remove internet exposure for all affected hosts by binding the listener to localhost or trusted subnets only and enforcing firewall/ACL rules - the only practical prerequisite for this attack is network reachability of the HFS2 listener. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute
Unauthenticated arbitrary file read, write, append, and delete in Rejetto HFS2 up to and including 2.4.0 allows remote a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today