{"id":"CVE-2026-107564","kind":"vulnerability","aliases":["CVE-2026-107564"],"related":[],"title":"Unauthenticated remote resource exhaustion causes denial of service in unnamed product","description":"An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.","summary":"Unauthenticated remote DoS in gocsaf csaf_provider (the CSAF advisory-publishing web service): requests cause uncontrolled resource allocation and high CPU load (CWE-770). Versions up to and including 3.6.0 are affected; 3.7.0 fixes it. The other gocsaf tools (aggregator, checker, downloader, uploader, validator) are not affected. Reported by github.com/kta1kri.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"csaf_provider","fixed":["3.7.0"],"affected":">= 0.0.0, <= 3.6.0","ecosystem":"go"}],"ecosystems":[],"tags":["csaf","csaf_provider","denial-of-service","go","gocsaf","other","self-hosted"],"not_affected_if":["csaf_aggregator-only","csaf_checker-only","csaf_downloader-only","csaf_provider-3.7.0-or-later","csaf_uploader-only","csaf_validator-only"],"how_to_check":"Run csaf_provider --version, or check the go module github.com/gocsaf/csaf version in go.mod or the deployed binary. Any version <= 3.6.0 is affected. Only matters if csaf_provider is network-reachable.","fix":"Update csaf_provider to 3.7.0 or later. As an interim measure, rate-limit or restrict access to the provider endpoint at the reverse proxy (my suggestion, not from the vendor).","status":"open","published_at":"2026-10-16T13:16:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:08+00:00","updated_at":"2026-10-24T00:27:51+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-23T22:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unauthenticated remote resource exhaustion causes denial of service in unnamed product","impact":"low","summary":"An unauthenticated remote attacker can send requests that drive CPU load very high because the affected product does not limit resource allocation. The result is a denial of service that takes the service offline.","category":"other","who_cares":[],"confidence":0.3,"needs_auth":"no","worst_case":"Service becomes unavailable through CPU exhaustion from unauthenticated requests","analyst_note":"Sources name no product or versions; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107564 and the vendor advisory to identify the affected component.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000446,"input_tokens":2860,"output_tokens":319,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources name no product or versions; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107564 and the vendor advisory to identify the affected component.","search":"'-107564':14A,17A '-2026':13A,16A '-770':57B '/kta1kri.':85B '3.6.0':63B '3.7.0':66B 'advisori':43B 'advisory-publish':42B 'affect':65B,80B,103C 'aggreg':73B 'alloc':51B,93C 'attack':89C 'caus':5A,48B,106C 'checker':74B 'cpu':54B,108C 'csaf':18A,20B,21B,38B,41B 'cve':12A,15A 'cwe':56B 'denial':6A,24B,113C 'denial-of-servic':23B 'dos':35B 'download':75B 'exhaust':4A 'fix':67B 'github.com':84B 'github.com/kta1kri.':83B 'go':27B 'gocsaf':28B,37B,71B 'high':53B,107C 'host':32B 'includ':62B 'lead':110C 'limit':97C 'load':55B,109C 'may':90C 'product':11A,104C 'provid':22B,39B 'provider':19A 'publish':44B 'remot':2A,34B,88C 'report':81B 'request':47B 'resourc':3A,50B,95C 'self':31B 'self-host':30B 'servic':8A,26B,46B,115C 'throttl':99C 'tool':72B 'unauthent':1A,33B,87C 'uncontrol':49B 'unnam':10A 'upload':76B 'use':91C 'valid':77B 'version':58B 'weak':100C 'web':45B 'without':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107564","severity":null,"published_at":"2026-10-16T13:16:54+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107564:668","url":null,"severity":null,"published_at":"2026-10-24T00:27:51+00:00","modified_at":"2026-10-24T00:27:51+00:00","first_seen_at":"2026-10-24T00:27:51+00:00","fetched_at":"2026-10-24T00:27:51+00:00","note":"Product identified as gocsaf csaf_provider via CVE record and the vendor's CSAF VEX gocsaf-2026-001 (read). Fixed in 3.7.0. No exploitation or PoC found; no social search done (niche product)."}],"documents":[{"id":2627,"url":"https://gocsaf.github.io/.well-known/csaf/white/2026/gocsaf-2026-001.json","title":"gocsaf-2026-001: csaf_provider uncontrolled resource consumption (CSAF VEX)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2628,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107564","title":"CVE Record: CVE-2026-107564","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}