CVE-2026-97362 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread
Unauthenticated attackers can cause a persistent denial of service in HFS2 by triggering a hung serving thread, requiring manual restart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97362?
CVE-2026-97362 is a high-severity denial of service vulnerability in rejetto hfs2, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.
Weakness: CWE-835
Which versions are affected by CVE-2026-97362?
How do I fix CVE-2026-97362?
No fix has been published for CVE-2026-97362 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97362 exists.
Sources
Also known as GHSA-99rf-x5r6-q76q.