CVE-2026-103471: restbed through 5.0.0 Denial of Service via Unbounded Header Buffering
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote, unauthenticated attacker able to establish TCP connections to a service using an affected restbed version can exploit it. No credentials or user interaction are required.
What traffic is required to trigger the denial of service?
An attacker opens TCP connections and continuously sends header bytes without sending the HTTP header delimiter. This causes the server to keep buffering data in heap memory until the process is killed.
Are affected deployments exposed by default?
The issue is in restbed's HTTP request-header buffering behavior through version 5.0.0. The provided information does not identify a configuration setting that enables a header-size limit or otherwise prevents the behavior.
How can I determine whether a service is under attack?
Look for open TCP connections that continuously send request data without completing HTTP headers, alongside increasing process heap memory usage. A successful attack can exhaust memory and terminate the service process.