CVE-2026-33256

49th percentile - higher than 49% of all known CVEs

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

If the internal web server is enabled, an attacker could exhaust memory and cause service unavailability. The default disabled state limits exposure, but configurations with the server enabled are vulnerable.

Keep the internal web server disabled if not needed, or restrict network access to it. Apply available updates containing the fix.