Red Hat ACM search-v2-api Unauthenticated DoS via Memory Exhaustion (CVE-2026-71469)

Vulnerability Overview CVE ID: CVE-2026-71469 Description: A vulnerability was discovered in . An unauthenticated attacker can exploit this vulnerability by sending requests containing a unique, random bearer token. Each unique token creates a permanent entry, leading to memory exhaustion in and resulting in a denial of service (DoS). CVSS Score: 7.5 (High) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Impact: High Availability Affected Scope Affected Component: component in Red Hat Advanced Cluster Management for Kubernetes Impact Type: Denial of Service (DoS) Technical Impact: Resource Consumption (CPU), Resource Consumption (Memory), Resource Consumption (Other) Remediation Mitigation Measures: Restrict network access to the component, allowing only trusted sources to access the search API. Implement network policies to limit incoming connections, thereby reducing the attack surface for unauthorized DoS attacks. After applying network policies, ensure that the pod is restarted to apply the new network rules. Additional Information CVSS v3 Score Details: - Base Score: 7.5 - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Impact: High Availability Common Weakness Enumeration (CWE): CWE-770 Frequently Asked Questions: - Why does Red Hat's CVSS v3 score differ from other vendors? - My product is listed as "Under Investigation" or "Affected." When will Red Hat release a fix for this vulnerability? - What should I do if my product is listed as "Not Affected"? - What should I do if my product is listed as "Fix Deferred"? - What is a mitigation measure? - I have a Red Hat product, but it is not listed above. Is it affected? - Why does my security scanner report that my product is vulnerable to this issue, even though my product version is patched or not affected? Contact Information: For clarifications or corrections, please contact the Red Hat Product Security team. Last Modified: 2021 Copyright: CVE Description Copyright © 2021 Summary This vulnerability affects the component in Red Hat Advanced Cluster Management for Kubernetes. An unauthenticated attacker can exploit this vulnerability by sending requests with unique, random bearer tokens, causing memory exhaustion and denial of service. The remediation involves restricting network access and implementing network policies. The CVSS score is 7.5, classifying it as a high-risk vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat ACM search-v2-api Unauthenticated DoS via Memory Exhaustion (CVE-2026-71469)

More from this source