CVE-2026-47213

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Improper Resource Shutdown or Release. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581
• https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82