CVE-2026-35505

Received Received - Intake

Memory Leak in Single-Process Service via Crafted Requests

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: ICS-CERT

Description

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-35505

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to repeatedly send specially crafted connection requests to a service.

These requests cause the service to leak memory, and in deployments where the service runs as a single process, the memory usage grows until the service is killed.

Once the service is killed, the port stops responding until the service is restarted.

Impact Analysis

The impact of this vulnerability is a denial of service condition.

Because the attacker can cause the service to consume increasing amounts of memory until it crashes, the affected service becomes unavailable.

This unavailability persists until the service is manually restarted, potentially disrupting normal operations.

Hi! I’m here to help you understand CVE-2026-35505. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70