PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107564 gocsaf Development Community CVE debrief

An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the gocsaf/csaf csaf_provider product to cause high CPU load leading to a denial of service. This vulnerability affects csaf_provider versions less than or equal to 3.6.0. Defenders should assess exposure and potential for denial of service attacks. The CVE record and source item provide details on the vulnerability, but do not offer specific information on exploitation or affected deployments.

Vendor
gocsaf Development Community
Product
csaf_provider
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-16
Advisory published
2026-10-16
Advisory updated
2026-10-16

Who should care

Defenders responsible for gocsaf/csaf deployments, particularly those using csaf_provider versions less than or equal to 3.6.0, should assess exposure and potential for denial of service attacks.

Why it matters

Defenders should prioritize verifying exposure of csaf_provider versions less than or equal to 3.6.0 and assessing the potential for denial of service attacks due to uncontrolled resource consumption.

  • Denial of service attacks may occur due to uncontrolled resource consumption
  • High CPU load may be caused by exploitation of the vulnerability
  • Verification of exposure is necessary for csaf_provider versions less than or equal to 3.6.0

Technical summary

The gocsaf/csaf csaf_provider product is prone to an uncontrolled resource consumption vulnerability, which can be exploited by an unauthenticated remote attacker to cause high CPU load leading to a denial of service. This vulnerability is due to a weakness in the allocation of resources without limits or throttling in csaf_provider versions less than or equal to 3.6.0. Defenders should prioritize verifying exposure of affected versions and assessing the potential for denial of service attacks.

Defensive priority

Defenders should prioritize verifying exposure of csaf_provider versions less than or equal to 3.6.0 and assessing the potential for denial of service attacks.

Recommended defensive actions

  • Verify exposure of csaf_provider versions less than or equal to 3.6.0
  • Assess the potential for denial of service attacks
  • Monitor for unusual CPU load patterns
  • Consider implementing rate limiting or throttling

Evidence notes

The CVE record and source item provide details on the vulnerability in csaf_provider, but do not offer specific information on exploitation or affected deployments.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107564 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107564

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107564 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107564

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.