CVE-2026-114405: Denial of Service via Malformed VATP Packet in Velneo vServer

Q: Which deployments are affected?

Velneo vServer versions from 36.0 before 36.6 and from 37.0 before 37.2 are affected. Deployments outside those stated version ranges are not identified as affected by the provided information.

Q: What should be done to remediate the issue?

Update affected 36.x deployments to 36.6 or later, and affected 37.x deployments to 37.2 or later.

Published Oct 21, 2026

Updated

Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.

Affected Software

1 affected component

Velneo vServer>=36.0<36.6, >=37.0<37.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Velneo vServer to a version that resolves this vulnerability.
Fixed in 36.6
Upgrade
Upgrade Velneo vServer to a version that resolves this vulnerability.
Fixed in 37.2

Event History

Oct 21, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Velneo vServer versions from 36.0 before 36.6 and from 37.0 before 37.2 are affected. Deployments outside those stated version ranges are not identified as affected by the provided information.

What should be done to remediate the issue?

Update affected 36.x deployments to 36.6 or later, and affected 37.x deployments to 37.2 or later.