EUVD-2026-89578
GHSA-p2fc-3c66-r2r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebRTC/API signaling endpoint
-
DeliveryAccess or initiate a gateway call
-
ExploitSend malformed signaling input
-
ExecutionTrigger software abort in signaling
-
ImpactDenial of service to conferencing users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to access a gateway call from a WebRTC or API client against Pexip Infinity signaling; the malformed signaling input then triggers a software abort. The key LIMITING factor is that the attacker must be able to reach the WebRTC/API entry point and obtain gateway-call access - so deployments that keep these interfaces internal, restrict gateway calling, or require call authorization substantially reduce exposure, while internet-facing Pexip Infinity nodes that permit open WebRTC/API gateway calls are directly at risk. Impact is limited to availability (crash of the signaling component); there is no confidentiality or integrity effect. Fixed in Pexip Infinity 41.0. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) presents this as a network-reachable, low-complexity, unauthenticated availability attack with scope change, which drives the 'High' rating almost entirely from the A:H plus S:C combination. However, the description materially qualifies the PR:N/AC:L picture: exploitation 'requires accessing a gateway call from a WebRTC/API client,' meaning the attacker must be able to reach and place/join a gateway call - a condition that is trivial only where Pexip's WebRTC/API entry points are internet-exposed and permit call access, and non-trivial where gateway calls are restricted. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or imminent exploitation; this is a vendor/MITRE-reported issue with a patch (fixed in 41.0), not a demonstrated in-the-wild threat. Impact is confined to availability (a software abort/crash of the signaling component) with no confidentiality or integrity loss. Net: a genuinely credible remote DoS worth patching promptly for internet-facing deployments, but the absence of exploitation signals and the gateway-call access precondition place it below a drop-everything emergency. Note the CWE-770 (resource allocation without limits) label sits somewhat awkwardly with the description's 'improper input validation' framing - verify the precise root cause with Pexip's bulletin. |
| Exploit ScenarioDerived | An attacker who can reach Pexip Infinity's WebRTC/API signaling interface joins or initiates a gateway call and sends crafted signaling input that fails validation, triggering a software abort in the signaling process. The resulting crash denies conferencing service to legitimate users. No public exploit code is identified at time of analysis, and the AV:N/AC:L vector means the malformed request is straightforward to deliver once gateway-call access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Malformed signaling input delivered to Pexip Infinity deployments running versions before 41.0 can abort the signaling software, denying conferencing service to users of the affected node. The issue is network-reachable and carries a CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), with the severity driven almost entirely by the high availability impact plus the scope-change component rather than by any loss of confidentiality or integrity. The CVSS vector's PR:N indicates no privilege requirement, but exploitation still carries an access precondition: the attacker must be able to reach the WebRTC/API signaling entry point and participate in a gateway call, so internet-facing nodes that permit open WebRTC/API gateway calling are directly at risk while internal-only or call-restricted deployments are substantially less exposed. There is no public exploit identified at time of analysis, and the fixed release (Pexip Infinity 41.0) is available.
RemediationAI
Upgrade to Pexip Infinity 41.0 or later, which is the vendor-released patch for this issue, and verify the installed build against the security bulletin at https://docs.pexip.com/admin/security_bulletins.htm. Where an immediate upgrade cannot be scheduled, reduce exposure by restricting network reachability to the WebRTC and API signaling entry points - ACL or firewall the signaling ports to trusted client networks or funnel them through a session border controller - accepting the trade-off that legitimate off-network WebRTC and API clients will lose connectivity until the upgrade is complete. If gateway calling is not a required workflow for the deployment, disable open gateway calls or enforce call authorization so that only verified participants can reach the code path that consumes the malformed signaling input; this removes or gates a feature for all users, which is the principal cost of the control. In addition, enable monitoring and automatic restart of the signaling services so that an abort produces the shortest possible outage while the upgrade window is arranged, and treat any unexpected signaling process crash as a possible exploitation attempt rather than a random fault, since the abort is the observable symptom of this flaw. No vendor-issued workaround beyond the 41.0 release is documented in the available advisory data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a software-based video conferencing and meeting platform whose signaling layer arbitrates call setup and control traffic, including connections arriving from WebRTC browsers and from the vendor's REST API, and whose gateway component bridges those sessions into other call environments. The defect sits in that signaling implementation, where supplied signaling input is not validated before it is consumed, and the failure mode reported by the vendor is a software abort of the signaling process. The record maps the root-cause class to CWE-770 (Allocation of Resources Without Limits or Throttling), which is consistent with the observed outcome - unvalidated signaling input driving the signaling component into an uncontrolled resource or state condition and terminating the process - while the advisory itself frames the underlying cause more generally as improper input validation. The CVSS vector includes S:C, indicating that the availability impact is assessed as extending beyond the vulnerable signaling component itself, which is why a crash-only bug still earns a High base score. No confidentiality or integrity effect is present in the assessed vector, so the practical risk is confined to service availability on the targeted node.
Know when Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-reachable signaling crash needing only gateway-call access (PR:N/AC:L); scope change as the signaling process affects the broader conferencing service; availability-only impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client.
Executive ViewAI
Pexip Infinity deployments running versions prior to 41.0 - the platform many organizations rely on for business video conferencing and WebRTC/API gateway calling - can be taken offline by malformed signaling input, denying conferencing service to every user on the affected node. Internet-facing nodes that permit open WebRTC/API gateway calling carry the greatest exposure, while internal-only or call-restricted deployments are substantially less exposed, and there is no loss of data confidentiality or integrity. Leadership should care because this is a network-reachable, unauthenticated availability outage on a business-critical communications service, and although a fixed release (41.0) exists, the source record's patch field is marked as not available, so current exposure depends on how many nodes remain below 41.0.
Apply vendor patch - upgrade to Pexip Infinity 41.0, the fixed release identified in the advisory context (note the source record's patch field is marked NOT available; confirm status with Pexip). Until the upgrade is complete: restrict the WebRTC/API signaling entry point to trusted network and partner ranges via firewall allowlists; disable or tightly gate open WebRTC/API gateway calling on internet-facing nodes; apply rate limiting and monitor signaling traffic for malformed input; and ensure conferencing traffic fails over to nodes that are not exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Pexip Infinity DoS, Access Control, and Memory Flaws
View all 9In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading t
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an att
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rate
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos
Exploit-DB