CVE-2026-115971
Received Received - Intake

Travisun Opptrix Buffer.concat Denial of Service

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulDB

Description
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-115971
EUVD
EUVD-2026-109309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Travisun Opptrix 0.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service (DoS) vulnerability in Travisun Opptrix 0.4.0. It exists in the Buffer.concat function of the /api/channels/webhook/ component's preParsing handler. An attacker can remotely trigger this flaw to cause the application to crash or become unavailable.

Detection Guidance

Since the project is deprecated and no longer supported, detection may involve checking for Opptrix 0.4.0 installations or unusual network traffic patterns targeting webhook endpoints. Review logs for excessive requests or crashes in the preParsing handler component.

Impact Analysis

If you are running Travisun Opptrix 0.4.0, an attacker could exploit this to disrupt service availability. However, the project is deprecated and no longer supported, so the risk is minimal unless you continue using the unsupported version.

Mitigation Strategies

Immediately uninstall or disable Opptrix 0.4.0 as it is deprecated and no longer supported. Block or monitor traffic to the affected webhook endpoint. Ensure no sensitive data relies on this deprecated system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart