Cloudburst Network, used by Cloudburst projects, has a flaw in its connection handling that omits bounds checks, allowing an attacker to drive the underlying Netty event loop to stall. Once the event loop is stalled, network processing halts and the running service becomes inoperable, effectively denying service to legitimate users. This flaw is a form of resource exhaustion, classified under CWE-770, and directly impacts the availability of any application that relies on the vulnerable library.

The vulnerability affects all systems that include CloudburstMC:Network versions older than 1.0.0.CR3-20260417.085727-30. Public‑facing applications built on earlier releases are susceptible, and any component that imports the affected library must be upgraded to the specified fixed build.

The CVSS score of 7.5 indicates high severity, and while no EPSS score is publicly available, the lack of exploitation evidence does not diminish the risk of a remote attack. The issue is not listed in the CISA KEV catalog, but its impact—stalling the event loop—can be executed by an external actor through normal network traffic. The most probable attack vector is remote, delivered via crafted packets that trigger the missing bounds checks during RakNet connection establishment.