← Back

CVE-2026-23822

nvd nist
Published: May 12, 2026Modified: Aug 12, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitability: 1.6 / Impact: 3.6
Source: security-alert@hpe.com (Secondary)

Description

A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x

Affected (4)

Arubanetworks
1 product
Arubaos
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Arubaos
From 6.4.0.0 to 6.5.4.24
Arubaos
From 8.11.0.0 to 8.12.0.7
Arubaos
From 8.13.0.0 to 8.13.1.2
Arubaos
From 8.4.0.0 to 8.10.0.22

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (1)

Source: security-alert@hpe.com
Vendor Advisory

Timeline

No history available yet.