Albatross
Monthly
Denial of service in Robur Albatross (specifically the albatross-console component) versions 1.0.0 through 2.x before 2.7.2 lets an authenticated user who can send console subscription commands drive the albatross-console process into an unterminated loop over the unikernel log ring buffer, consuming CPU and making console access unavailable. Exploitation requires the targeted unikernel to have generated enough output to fill the 1024-line ring buffer, and the request must specify a very high or negative line count, or a timestamp earlier than every buffered message; the vendor states it is not exploitable by unauthorized clients, and the independent assessment confirms PR:L with availability-only impact (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, so this is a genuine but bounded availability risk rather than a high-urgency threat.
Denial of service in Robur Albatross (specifically the albatross-console component) versions 1.0.0 through 2.x before 2.7.2 lets an authenticated user who can send console subscription commands drive the albatross-console process into an unterminated loop over the unikernel log ring buffer, consuming CPU and making console access unavailable. Exploitation requires the targeted unikernel to have generated enough output to fill the 1024-line ring buffer, and the request must specify a very high or negative line count, or a timestamp earlier than every buffered message; the vendor states it is not exploitable by unauthorized clients, and the independent assessment confirms PR:L with availability-only impact (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, so this is a genuine but bounded availability risk rather than a high-urgency threat.