CVE-2025-41706
MediumCVSS 5.3Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
Risk Assessment
An attacker can remotely and without authentication cause unavailability of the webserver, disrupting services that rely on it.
Recommendation
Apply available vendor updates or mitigations and consider limiting header sizes at the server/proxy level.
Other vulnerabilities in Webserver
See all- CVE-2026-22102Critical
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
- CVE-2026-22096Critical
The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.
- CVE-2026-22095Critical
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
- CVE-2026-1696Medium
The web server does not properly set some HTTP security headers in responses sent to client applications. This can weaken protection against attacks such as XSS, clickjacking, and other threats due to missing security headers.
Original NVD description (English source)
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS