Cyber Resilience

CVE-2026-54224

DoS

DoS
Published
18 June 2026
Modified
18 June 2026
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 19th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-54224 is a high-severity Amplification (CWE-405) vulnerability in Cert (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Service Exhaustion Flood (T1499.002); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for…

more

other users. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

CWE(s)
CWE-405

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

CWE-405 resource exhaustion via concurrent profile requests directly enables service/application DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-8677Shared CWE-405
CVE-2026-24324Shared CWE-405
CVE-2025-30204Shared CWE-405
CVE-2026-22775Shared CWE-405
CVE-2025-68480Shared CWE-405
CVE-2026-35665Shared CWE-405
CVE-2026-25611Shared CWE-405
CVE-2025-66506Shared CWE-405
CVE-2025-66564Shared CWE-405
CVE-2026-22774Shared CWE-405

Affected Assets

Cert
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-5 Denial-of-service Protection
  • AC-10 Concurrent Session Control
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-5 Denial-of-service Protection good match
prevent

Directly requires mechanisms to protect against or limit effects of DoS attacks that exhaust resources via high-volume requests.

AC-10 Concurrent Session Control good match
prevent

Limits concurrent sessions/requests per authenticated user, directly blocking the multiple simultaneous profile-view requests that trigger DB exhaustion.

SI-4 System Monitoring partial match
detect

Enables monitoring and analysis of traffic patterns to identify anomalous concurrent request volumes targeting user-profile endpoints.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-03 mostly match
prevents

Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.

PR.IR-04 mostly match
prevents

Capacity planning and monitoring maintain availability headroom against amplification attacks.

DE.CM-01 partial match
prevents

Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.

DE.CM-09 partial match
prevents

Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.6 Capacity management none match
none

Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.

References