Robur Albatross versions 1.0.0 up to 2.x before 2.7.2 lack a limit on the ring buffer used by the console. When an attacker sends subscription commands that generate enough log output to a unikernel, the buffer can grow to 1024 lines. Once full, the albatross-console process enters a never‑terminating loop that consumes excessive CPU and memory, ultimately making the system unresponsive. This vulnerability therefore causes a denial‑of‑service through resource exhaustion rather than a crash or code execution.

The affected product is Robur Albatross. All releases from 1.0.0 through any 2.x version prior to 2.7.2 are vulnerable. Versions 2.7.2 and later contain the patch that limits the ring buffer size.

The CVSS score of 7.1 places this issue in the high‑severity range, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can issue console subscription commands to a unikernel that emits sufficient log lines, making the attack limited to authorized or privileged users. The absence of publicly known exploits and the availability of a fixed version reduce the likelihood of an immediate widespread attack, though the impact remains high for exposed environments.