Corvusoft Restbed: Denial of service via unbounded HTTP header buffering
Summary
Restbed, a C++ framework for asynchronous REST services, reads HTTP request headers without a maximum size limit in versions up to and including 5.0.0. A remote, unauthenticated attacker can open TCP connections and stream header data without the end-of-header marker, so the server keeps allocating memory until the process is killed. The impact is limited to availability, and exposure depends on whether an application built on Restbed listens on untrusted networks.
Affected
- Corvusoft Restbed up to and including 5.0.0
- Applications, appliances or embedded devices that embed Restbed in these versions
Fixed in
Unknown. No fixed release or Corvusoft security advisory was found. Check the upstream repository for a commit or release after 5.0.0.
Workaround
- Place a reverse proxy or load balancer in front of the service that enforces header size and connection time limits.
- Restrict access to Restbed-based services to trusted networks or VPN.
- Run the service under a supervisor that restarts it. This limits the impact but does not remove the flaw.
Exploitation
- CISA SSVC lists exploitation as "poc" and the issue is automatable.
- No known exploitation in the wild. No exploit code was found in the research.
Our recommendation
- Ask software vendors and in-house developers whether their products use Restbed.
- Check lockfiles and deployed binaries for Restbed.
- Confirm that any exposed service sits behind a proxy or firewall with request limits.
- Monitor the upstream repository and the vendor for a fixed version and update when available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Corvusoft Restbed GitHub repository github.com
- Restbed issue #558 github.com
- Restbed service_impl.cpp at e1227a2 github.com
- Restbed session.cpp at e1227a2 github.com
- VulnCheck advisory: restbed through 5.0.0 denial of service www.vulncheck.com
- OSV: CVE-2026-103471 osv.dev
- VulDB entry 412320 vuldb.com
- HOL Guard: CVE-2026-103471 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:35.
Original description (NVD)
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.
NVD references (6)
- https://github.com/Corvusoft/restbed
- https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/deta…
- https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/sess…
- https://github.com/Corvusoft/restbed/issues/558
- https://www.vulncheck.com/advisories/restbed-through-5.0.0-denial-of-service-via-unbounded-header-buffering
- https://github.com/Corvusoft/restbed/issues/558
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.