{"id":"CVE-2026-120854","kind":"vulnerability","aliases":["CVE-2026-120854"],"related":[],"title":"iubenda cookie-law plugin: unlimited resource allocation enables HTTP denial of service","description":"Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.","summary":"The iubenda cookie-law solution allocates resources without limits or throttling, so a remote HTTP request can exhaust them. An attacker can take the affected site or service offline by flooding it with requests.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"iubenda-cookie-law-solution","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cookie-law","iubenda","other","wordpress-plugin"],"not_affected_if":["version-above-3.13.6"],"how_to_check":"- Check the installed iubenda cookie-law plugin version against the affected range (through `3.13.6`).","fix":"- Move to a version later than `3.13.6`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:30+00:00","updated_at":"2026-11-09T13:27:30+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T13:27:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `3.13.6`; the sources do not name the fixed version.","reach":"internet","title":"iubenda cookie-law plugin: unlimited resource allocation enables HTTP denial of service","impact":"low","summary":"The iubenda cookie-law solution allocates resources without limits or throttling, so a remote HTTP request can exhaust them. An attacker can take the affected site or service offline by flooding it with requests.","audience":"businesses","category":"other","nicknames":[],"who_cares":["iubenda","cookie-law","wordpress-plugin"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker makes the service unavailable through resource exhaustion","analyst_note":"Confirm the fixed version and the exact product (WordPress plugin or other) from the NVD entry and the vendor advisory.","how_to_check":"- Check the installed iubenda cookie-law plugin version against the affected range (through `3.13.6`).\n- unknown","plain_action":"","product_name":"iubenda-cookie-law-solution","needs_analyst":true,"not_affected_if":["version-above-3.13.6"],"who_is_affected":"Sites and services running the iubenda cookie-law solution at version `3.13.6` or earlier are exposed to HTTP denial of service. The sources do not say which deployment configurations are affected, so unknown beyond the version range.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4538,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120854':16A,19A '-2026':15A,18A '3.13.6':93C 'affect':58B,88C 'alloc':8A,39B,68C 'allow':84C 'attack':54B 'cooki':3A,26B,36B,81C 'cookie':22A 'cookie-law':2A,25B,35B 'cve':14A,17A 'denial':11A 'dos.this':86C 'enabl':9A 'exhaust':51B 'flood':64B 'http':10A,48B,85C 'issu':87C 'iubenda':1A,21A,28B,34B,77C,78C,80C,89C 'iubenda-cookie-law-solut':79C 'iubenda-cookie-law-solution':20A 'law':4A,23A,27B,37B,82C 'limit':42B,72C 'n/a':91C 'offlin':62B 'plugin':5A,32B 'remot':47B 'request':49B,67B 'resourc':7A,40B,70C 'servic':13A,61B 'site':59B 'solut':38B,83C 'solution':24A 'take':56B 'throttl':44B,74C 'unlimit':6A 'vulner':75C 'without':41B,71C 'wordpress':31B 'wordpress-plugin':30B","nicknames":[],"mitigations":[],"who_affected":"Sites and services running the iubenda cookie-law solution at version `3.13.6` or earlier are exposed to HTTP denial of service. The sources do not say which deployment configurations are affected, so unknown beyond the version range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["iubendacookielawsolution"],"ptokens":["cookie","iubenda","law","solution"],"labels":["cookielaw","high","iubenda","other","vendor","wordpressplugin"],"campaign_type":null,"search_a":"'-120854':16A,19A '-2026':15A,18A 'alloc':8A 'cooki':3A 'cookie':22A 'cookie-law':2A 'cve':14A,17A 'denial':11A 'enabl':9A 'http':10A 'iubenda':1A,21A 'iubenda-cookie-law-solution':20A 'law':4A,23A 'plugin':5A 'resourc':7A 'servic':13A 'solution':24A 'unlimit':6A","search_b":"'affect':58B 'alloc':39B 'attack':54B 'cooki':26B,36B 'cookie-law':25B,35B 'exhaust':51B 'flood':64B 'http':48B 'iubenda':28B,34B 'law':27B,37B 'limit':42B 'offlin':62B 'plugin':32B 'remot':47B 'request':49B,67B 'resourc':40B 'servic':61B 'site':59B 'solut':38B 'take':56B 'throttl':44B 'without':41B 'wordpress':31B 'wordpress-plugin':30B","search_c":"'3.13.6':93C 'affect':88C 'alloc':68C 'allow':84C 'cooki':81C 'dos.this':86C 'http':85C 'issu':87C 'iubenda':77C,78C,80C,89C 'iubenda-cookie-law-solut':79C 'law':82C 'limit':72C 'n/a':91C 'resourc':70C 'solut':83C 'throttl':74C 'vulner':75C 'without':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120854","severity":null,"published_at":"2026-11-09T13:17:06+00:00","modified_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}