CVE-2026-97362

HighCVSS 7.5/10Last modified Sep 24, 2026

Description

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
rejettohfs2>= 2.0.0, <= 2.4.0

References

Timeline

Published
Sep 24, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-973637.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting mCVE-2026-973656.3A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.CVE-2026-973666.3A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of theCVE-2026-973686.3A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-CVE-2026-97376.5During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case.CVE-2026-973707.5Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.javaCVE-2026-97384.4The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' paraCVE-2026-973808.8MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CVE-2026-973819.9Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin CVE-2026-97399.4Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `alloweCVE-2026-973947.5kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas withoutCVE-2026-973958.1Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings