The bug in Cloudburst Network causes the parent Netty channel to be closed when an attacker sends an invalid connection request. The error handling in the library misinterprets the malformed data, terminating the channel and rendering the affected application inoperable. This results in a denial of service for users of software that relies on the compromised library.

The vulnerability affects all releases of CloudburstMC:Network before version 1.0.0.CR3-20260418.124334-32. Systems built on these versions—including any Cloudburst project that imports the Network library—are potentially exposed. Upgrade to the specified version or later to eliminate the issue.

With a CVSS score of 7.5, the flaw is considered high risk. Exploitation requires only the ability to establish a network connection to the vulnerable component, making it a remote attack vector. No mitigation exists other than replacing the library, and the vulnerability is not listed in CISA’s KEV catalog, though the lack of an EPSS value does not imply low threat. Administrators should treat the problem as an urgent security issue.