An attacker that can reach a container’s published TCP port may force the host’s forwarding process to buffer an unbounded amount of that client’s data in memory for as long as the backend container connection takes to complete. Because there is no cap on how much data can accumulate or how long the wait can be stretched, the application can be forced into a state of uncontrolled memory growth, potentially exhausting host resources and rendering the host or container unresponsive. The vulnerability does not directly expose data or privileges, but it can disrupt availability for any user or service relying on the host.

Apple’s container product is affected, specifically any version of the container before 1.2.0. The advisory indicates that version 1.2.0 addresses the issue, so deployments using earlier releases are vulnerable.

The bug is reachable via a network connection exposed on the container’s forwarded TCP port, so an attacker with network access to the port can launch the exploit. No elevated privileges are required to trigger the denial of service. With a CVSS score of 7.5 and a very low EPSS score (< 1%), the potential for large memory consumption and prolonged impact makes the risk significant for exposed containers. If unpatched, an attacker could craft a connection that keeps the backend alive and siphon memory rapidly, causing the host to become unusable.