CVE-2026-45291: Cloudburst Network erroneously handles invalid connections

Synopsis

This is a denial-of-service vulnerability in Cloudburst Network, a networking library used by Cloudburst projects. It is reachable over the network with no authentication required, meaning any remote attacker can trigger it without credentials. Successful exploitation allows the attacker to force-close the parent Netty channel, rendering the service inoperable. No fix version has been officially published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network; publicly accessible deployments embedding Cloudburst Network are directly exposed.

• AuthenticationNot required

  No credentials or prior account access are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the exploit is driven entirely by the attacker sending crafted network traffic.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Crashes the parent Netty channel in the affected service, taking it completely offline.
• All in-flight and subsequent connections to the service are dropped, producing a full denial of service for end users.
• Recovery requires a process restart or redeployment, extending downtime depending on operator response time.