Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115971— Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

Quick assessment

Affected

Travisun Opptrix

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Travisun Opptrix 0.4.0 中发现了一个安全漏洞。该漏洞影响位于文件中、preParsing 处理组件内的函数。攻击者通过构造特定输入可触发拒绝服务（DoS）。该攻击可远程发起，且利用方式已被公开，可能被利用。目前，该项目已完全下线并停止维护。项目维护者说明：“所提及的安全风险是一个设计缺陷，主要在项目早期开发阶段在本地环境中显现。我们此前已针对该特定风险进行了修复；但由于该项目仅限于小规模学习用途，且主要版本设计为仅在 localhost 上运行，因此安全修复仅直接提交至我们的 GitH

CVSS 5.3 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Travisun	Opptrix	`0.4.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不恰当的资源关闭或释放

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Travisun	Opptrix	0.4.0	`cpe:2.3:a:travisun:opptrix::::::::`

II. Public POCs for CVE-2026-115971

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115971

请登录查看更多情报信息。

Other References for CVE-2026-115971 (1)

🔗 Opptrix Webhook - Google Drive exploit

https://www.cve.org/CVERecord?id=CVE-2026-115971

Same Patch Batch · Travisun · 2026-10-24 · 3 CVEs total

CVE-2026-115969	7.3 HIGH	Travisun Opptrix Schedule API setup command injection
CVE-2026-115970	7.3 HIGH	Travisun Opptrix Import Endpoint import code injection

IV. Related Vulnerabilities

Same product: Opptrix

Same vendor: Travisun

Same weakness: CWE-404