CVE-2026-115971

Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

The flaw lies in the Buffer.concat implementation of the preParsing handler in the webhook endpoint. An attacker can send crafted requests that cause the concatenation operation to exhaust resources, triggering a denial of service. The impact is loss of availability for the affected system; no known data exfiltration or code execution occurs. The known weakness is CWE-404, a failure to handle edge cases in input processing.

Affected Systems

Travisun Opptrix version 0.4.0 is affected. This product has been taken offline, deprecated, and is no longer supported by its maintainer. No other versions or variants are reported to be vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. EPSS data is missing, but the exploit has been publicly released, and the attack can be launched remotely, implying a realistic exploitation risk. The vulnerability is not listed in the CISA KEV catalog. Because the project is unsupported, the risk remains persistent for any installations that continue to use this software.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Discontinue use of Travisun Opptrix 0.4.0 and migrate to a supported alternative.
  • Immediately block or remove the publicly exposed preParsing webhook endpoint to prevent remote exploitation.
  • Audit system logs for anomalies and document any attack attempts to inform incident response.

Generated by OpenCVE AI on October 24, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Title Travisun Opptrix preParsing handler webhook Buffer.concat denial of service
First Time appeared Travisun
Travisun opptrix
Weaknesses CWE-404
CPEs cpe:2.3:a:travisun:opptrix:*:*:*:*:*:*:*:*
Vendors & Products Travisun
Travisun opptrix
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 5:38 PM
Reserved
Oct 24, 2026, 12:49 AM

View source JSON

Updated
Oct 26, 2026, 4:09 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 6:16 PM
Modified
Oct 26, 2026, 6:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 7:00 PM

JSON