CVE-2026-19507

Received Received - Intake

Uncontrolled Resource Consumption in RDK-B WebUI

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: CERT/CC

Description

Uncontrolled resource consumption in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause denial of service via excessively large password values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-19507

EUVD

EUVD-2026-62715

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled resource consumption in the file check.jst within the RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26. A remote attacker without authentication can exploit it by sending excessively large password values, leading to a denial of service condition.

Impact Analysis

The vulnerability allows an attacker to disrupt the availability of the RDK-B WebUI service by consuming excessive server resources. This can result in the service becoming unresponsive or crashing, affecting legitimate users' access.

Mitigation Strategies

Update to a patched version of RDK-B WebUI beyond rdkb-2025q4-kirkstone.04.10.26. Monitor network traffic for unusually large password values sent to check.jst. Implement rate limiting on authentication endpoints.

Hi! I’m here to help you understand CVE-2026-19507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70