gocsaf csaf_provider: Uncontrolled resource consumption leads to denial of service
Summary
The csaf_provider component of the gocsaf/csaf project, a tool for publishing CSAF security advisories, does not limit resource allocation. An unauthenticated remote attacker can send requests that cause high CPU load and a denial of service. The flaw is reachable before the password check, so exposed instances are at risk.
Affected
- csaf_provider versions 0.0.0 through 3.6.0 (CNA range)
- VulDB lists 3.0 to 3.6.0; the vendor advisory should be checked for the exact range
- Other gocsaf components (csaf_aggregator, csaf_checker, csaf_downloader, csaf_uploader, csaf_validator) are not affected according to the vendor
Fixed in
- Version 3.7.0 is reported as fixed by the vendor
- Unknown: the vendor advisory could not be verified in this assessment
Workaround
- Disable csaf_provider or restrict access to trusted networks until a fixed version is confirmed
- Unknown: no vendor-confirmed workaround beyond access restriction
Exploitation
- VulDB and PSIRT list no public exploit and no CISA KEV entry
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No reports of in-the-wild exploitation were found
Our recommendation
- Check whether csaf_provider is installed, including its CGI endpoint
- If installed and reachable from the internet, restrict access to trusted networks or disable it
- Update to version 3.7.0 or later once confirmed by the vendor advisory
- Monitor the vendor advisory and CPU load on affected hosts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-107564 vendor advisory gocsaf-2026-001 gocsaf.github.io
- CVE Record CVE-2026-107564 www.strix.ai
- VulDB entry 421278 vuldb.com
- PSIRT CVE-2026-107564 psirt.com
- Upstream GitHub issue 776 github.com
- csaf_provider Go package documentation pkg.go.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:22.
Original description (NVD)
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.