CVE-2026-78250
Received Received - Intake

Infinite Loop in bytebot-ai bytebot Agent Execution Workflow

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78250
EUVD
EUVD-2026-64854

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bytebot-ai bytebot 0.0.1
bytebot-ai bytebot to 0.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in bytebot-ai bytebot version 0.0.1. It occurs in the Agent Execution Workflow where a lack of iteration limits allows an infinite loop. A malicious or malformed task prompt can cause the agent to repeatedly call models and tools, storing excessive data and monopolizing system resources.

Detection Guidance

Monitor for unusually high CPU or memory usage by the bytebot process, excessive database growth, or pending tasks not completing. Check logs for repeated tool calls or model invocations without termination. Use system monitoring tools like top, htop, or ps to observe process behavior and resource consumption.

Impact Analysis

The vulnerability can lead to task queue starvation, database growth, and system unavailability for legitimate users. It may consume shared resources like CPU, memory, and storage, causing performance degradation or complete service disruption.

Compliance Impact

This vulnerability could lead to denial of service by monopolizing shared resources, causing system unavailability. For GDPR, this may violate Article 32 (security of processing) due to lack of availability safeguards. For HIPAA, it could disrupt access to protected health information systems, potentially violating the Security Rule's integrity and availability requirements.

Mitigation Strategies

Disable or isolate bytebot 0.0.1 immediately. Apply execution budget limits for iterations, tool calls, and time. Implement fairness mechanisms to prevent task starvation. Update to a supported version if available or apply patches enforcing budget checks and cancellation propagation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart