EUVD-2026-89576
GHSA-rfhw-p37j-8vqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Infinity node web server
-
DeliverySend malformed/crafted request
-
ExploitTrigger improper input validation
-
ExecutionExhaust resources or crash service
-
ImpactNode rendered inaccessible (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network access to the web server of a Pexip Infinity node running an affected version (30.0 through 40.x, before 41.0); the attacker sends input the web server fails to validate properly (CWE-770). No authentication (PR:N) and no user interaction (UI:N) are needed, so any deployment exposing the node's web interface to an attacker is at risk. Limiting factors: impact is confined to availability (the node becomes inaccessible) with no confidentiality or integrity effect, and exposure depends on whether the management/conferencing web interface is network-reachable to untrusted networks rather than restricted behind perimeter controls. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes a network-reachable, low-complexity, unauthenticated denial-of-service against the Pexip Infinity node's web server, with availability as the sole impact (no confidentiality or integrity loss). The elevated 8.6 score is driven almost entirely by the S:C scope-change flag combined with A:H; without scope change this would score 7.5, so the reported severity hinges on the assertion that crashing the web-server component impacts a component beyond the vulnerable one - a claim the terse MITRE description does not substantiate and which should be verified against the Pexip bulletin. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from these signals. This is best treated as a genuine but bounded availability risk: trivially triggerable if exposed, but with no data-theft or code-execution consequence and no evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to a Pexip Infinity node's web interface sends a crafted, malformed request that the web server fails to validate, exhausting resources or crashing the service and rendering the node inaccessible to legitimate conferencing users. No authentication or user interaction is required, making it a simple remote disruption. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Denial of service in Pexip Infinity 30.0 through 40.x allows unauthenticated remote attackers to render a node inaccessible by sending input that the web server fails to validate properly (CWE-770). The flaw is network-reachable and low-complexity with no authentication (PR:N) or user interaction (UI:N) required, and its sole impact is availability - there is no confidentiality or integrity loss - with CVSS 3.1 scored 8.6. No public exploit code and no confirmed active exploitation were identified at time of analysis; risk is concentrated in deployments whose management or conferencing web interface is exposed to untrusted networks.
RemediationAI
Vendor-released patch: Pexip Infinity 41.0 (and later) resolves the flaw; upgrade every node in the 30.0 through 40.x range to 41.0 or a subsequent release and verify the fix against the bulletin at https://docs.pexip.com/admin/security_bulletins.htm. Where an immediate upgrade is not possible, the primary compensating control is to stop exposing the node's web server to untrusted networks: restrict the management interface to a dedicated administrative VLAN or management network, and apply firewall rules or ACLs permitting only trusted source addresses to reach the web ports. The trade-off is reduced administrative and conferencing convenience - remote administrators will need VPN or jump-host access, and any conferencing features that depend on the public web interface on that node must be re-routed or temporarily decommissioned. Because the attack requires only network reachability and no authentication, rate limiting or a reverse proxy in front of the web interface offers only partial and easily bypassed protection and should not be treated as a substitute for the upgrade. Continue to monitor the vendor advisory for backported fixes to older supported branches, since absence of a listed patch for a given branch is not confirmation that one will not be issued.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a distributed video-conferencing and interoperability platform whose nodes expose an HTTP-based web interface for administration and conferencing services. The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), which manifests here as improper input validation in the web server: crafted requests are accepted without adequate bounds or sanity checking, allowing resource consumption to go unbounded until the node becomes unreachable. Although the accompanying description frames the issue as 'improper input validation', the CWE-770 assignment indicates the practical effect is resource exhaustion or service lock-up rather than memory corruption or code execution. The CPE entry cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* confirms the affected component is the Infinity product line itself across the 30.0-40.x branch prior to 41.0. Impact is confined to availability (C:N/I:N/A:H); the CVSS vector AV:N/AC:L/PR:N/UI:N indicates the attack is remotely reachable, requires no privileges or interaction, and needs only that the node's web interface be network-accessible to the attacker.
Know when Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network DoS of the web server with only availability impact; I assess S:U rather than the input's S:C because the description shows only the node itself made inaccessible, not a separate component.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible.
Executive ViewAI
Pexip Infinity versions 30.0 through 40.x are affected by a high-severity denial-of-service vulnerability that can render conferencing nodes inaccessible, disrupting critical communications. No public exploit identified at time of analysis, but the flaw is unauthenticated and remotely exploitable, and no vendor-released patch identified at time of analysis, leaving organizations reliant on interim mitigations. Leadership should ensure that exposed management and conferencing interfaces are secured to prevent service outages.
Restrict network access to Pexip Infinity web interfaces (management and conferencing) to trusted networks or VPN; implement rate limiting and monitoring for anomalous traffic; apply any vendor-provided workarounds; consider disabling remote management if not required; and segment conferencing nodes from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Pexip Infinity DoS, Access Control, and Memory Flaws
View all 9In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading t
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an att
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rate
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos
Exploit-DB