CVE-2026-97362
Received Received - Intake

Denial of Service in HFS2 File Server

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97362
EUVD
EUVD-2026-85921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rejetto hfs2 From 2.0.0 (inc) to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-97362 is a denial-of-service (DoS) vulnerability in HFS2 versions 2.4.0 and earlier. It allows unauthenticated attackers to send a single crafted request that causes a serving thread to enter an infinite loop, making the entire file server unresponsive until manually restarted. The issue stems from a non-terminating loop in the getKeyFromString() function when processing configuration lookups.

Detection Guidance

To detect this vulnerability, monitor for HFS2 servers running versions 2.0.0 through 2.4.0 that become unresponsive to requests. Check server logs for repeated failed connections or hung threads. Use network scanning tools like nmap to identify HFS2 instances on your network.

Impact Analysis

This vulnerability can lead to complete loss of server availability. The server becomes unresponsive to all clients, requiring a manual restart to recover. It affects file server operations, disrupts access to shared files, and may cause downtime for services relying on HFS2.

Mitigation Strategies

Immediately restrict access to HFS2 servers to trusted networks only. Disable the {.get ini.} template macro if present. Consider using process wrappers to auto-restart hung instances. Upgrade to a patched version once available or apply vendor fixes to the getKeyFromString() function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart