restbed EUVD-2026-90202

Exploitable against any internet- or network-reachable restbed (Corvusoft) HTTP service at version 5.0.0 or earlier that accepts client connections in its default configuration - no authentication, credentials, special feature flag, or user interaction is needed. The only real prerequisite is network reachability to the listening port and the ability to hold TCP connections open while dribbling bytes. Limiting factors are minimal: impact is confined to availability (service crash/DoS, no data or code compromise), and exposure depends on whether the restbed service is directly reachable versus fronted by a reverse proxy or load balancer that enforces its own header-size/timeout limits (which would blunt the attack).

All signals align on a genuine but impact-limited issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: remote, network-reachable, no authentication, no user interaction, and availability-only impact - confidentiality and integrity are correctly scored N because unbounded header buffering leaks or corrupts nothing, it only exhausts heap until the process is OOM-killed. There is no CVSS/description conflict to flag. No EPSS score, no CISA KEV listing, and no explicitly published exploit were provided, so this is 'no public exploit identified at time of analysis.' However, the technical barrier is near-zero: the attack is a Slowloris-style primitive (open a socket, stream header bytes without the terminating CRLFCRLF), so absence of a packaged PoC should not be read as low feasibility. Net: this is a real, easily-triggered availability risk against exposed restbed services, but it is capped at denial-of-service - it is not an RCE or data-exposure priority. The 8.7 'high' score is driven entirely by easy remote reachability, not by impact breadth; prioritize it according to how exposed and business-critical the restbed service is.

An attacker reachable over the network opens one or more TCP connections to a restbed-based HTTP service and slowly streams header bytes, never sending the blank-line delimiter that would end the header section. Because restbed buffers headers with no maximum-size cap, each connection forces ever-growing heap allocation until the process is killed by the OS, taking the service offline. No authentication, credentials, or victim interaction is required; no public exploit tool is identified, but the technique is trivial to script.