CVE-2026-96609 PUBLISHED

Assigner: mitre
Reserved: 23.09.2026 Published: 23.09.2026 Updated: 23.09.2026

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor Robur
Product Albatross
Versions Default: unaffected
  • affected from 1.0.0 to 2.7.2 (excl.)

Solutions

Apply the patch, or upgrade to version that includes the patch (2.7.2+).

References

Problem Types

  • CWE-770 Allocation of Resources Without Limits or Throttling CWE