CVE-2026-70616
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-70616 is a high-severity Deadlock (CWE-833) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-53598
Vulnerability Data
boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs…
more
no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.3
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities can exercise concurrent paths and resource contention to discover deadlock conditions before deployment.
Security engineering principles applied during design can incorporate synchronization ordering, timeouts, and resource hierarchies that structurally avoid deadlock formation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices can include concurrency analysis and lock discipline to avoid deadlock conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect deadlock conditions through stress and concurrency testing.
Secure development lifecycle requires deadlock analysis and avoidance techniques during design and coding.
Secure system architecture principles include concurrency controls and resource-locking discipline that prevent deadlock.
Secure coding standards mandate safe lock ordering, timeouts, and deadlock detection patterns.
Change management may catch deadlock-related defects during reviews but does not directly address concurrency design.