CVE-2026-96609
Received Received - Intake

Robur Albatross Ring Buffer Exhaustion DoS

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: MITRE

Description
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96609
EUVD
EUVD-2026-85307

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
robur albatross From 1.0.0 (inc) to 2.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a loop in the Albatross console that lacks a termination condition due to an unchecked ring buffer. The ring buffer can be filled by users with console subscription commands that generate enough log output (1024 lines). This causes the system to loop indefinitely without proper handling.

Detection Guidance

Detect this vulnerability by monitoring for albatross-console loops or excessive log output that fills the ring buffer. Check for processes consuming high memory or CPU due to unchecked ring buffer usage. Use system monitoring tools like top, htop, or ps to observe unusual activity in albatross processes.

Impact Analysis

The vulnerability can lead to denial of service by consuming excessive system resources, causing the console to hang or crash. It requires the attacker to have access to send console commands, limiting exploitation to authorized users.

Compliance Impact

The vulnerability allows unauthorized users with console access to trigger excessive log output, potentially filling the ring buffer. This could lead to denial-of-service conditions or resource exhaustion, which may impact system availability and integrity. Such disruptions could violate compliance requirements for data protection and availability under standards like GDPR (availability principle) or HIPAA (security and integrity of PHI).

Mitigation Strategies

Upgrade Albatross to version 2.7.2 or later to apply the fix. If upgrading is not immediately possible, restrict access to console subscription commands for users who can trigger the issue. Monitor system logs for signs of exploitation and limit log output to prevent buffer overflow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart