CVE-2026-115793
Resource exhaustion from RPC sessions kept for requests to unknown interface
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 29, 2026
- Updated
- Oct 29, 2026
- Reserved
- Oct 23, 2026
Description
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | rt-labs |
Weaknesses
- CWE-772 Missing Release of Resource after Effective Lifetime
Affected Products
| Product | Versions |
|---|---|
P-NetRT-Labs |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.