Vulnerability-Lookup

FKIE_CVE-2026-64773

Vulnerability from fkie_nvd - Published: 2026-08-20 22:17 - Updated: 2026-10-18 20:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.

References

	URL	Tags
	product-security@apple.com	https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6	Patch, Vendor Advisory, Mitigation

Impacted products

	Vendor	Product	Version
	apple	container	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "container",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@apple.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:container:*:*:*:*:*:swift:*:*",
              "matchCriteriaId": "232C46CA-462E-4E38-99EF-8B8D14843D72",
              "versionEndExcluding": "1.2.0",
              "versionStartIncluding": "0.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker that can reach a container\u0027s published TCP port may be able to force the host\u0027s forwarding process to buffer an unbounded amount of that client\u0027s data in memory, for as long as the backend container connection takes to complete \u2014 with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0."
    },
    {
      "lang": "es",
      "value": "Un atacante que puede alcanzar el puerto TCP publicado de un contenedor podr\u00eda ser capaz de forzar al proceso de reenv\u00edo del host a almacenar en b\u00fafer una cantidad ilimitada de los datos de ese cliente en memoria, durante el tiempo que tarde en completarse la conexi\u00f3n del contenedor de backend - sin l\u00edmite en cu\u00e1nto se acumula o cu\u00e1nto se puede prolongar la espera. Esta vulnerabilidad se aborda en la versi\u00f3n 1.2.0 del contenedor."
    }
  ],
  "id": "CVE-2026-64773",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64773",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-28T15:08:30.708331Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T22:17:48.603",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Patch",
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2026-64773 (GCVE-0-2026-64773)

Vulnerability from cvelistv5 – Published: 2026-08-20 21:16 – Updated: 2026-10-19 20:48

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:08 UTC

CWE

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched.
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

apple CNA under the mitre root

CNA scorecard E 37/100 over 992 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/apple/container/security/advis…

Impacted products

1 product

Vendor	Product	Version
Apple	container	Affected: 0 , < 1.2.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-64773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:08:30.708331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:44.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "container",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker that can reach a container\u0027s published TCP port may be able to force the host\u0027s forwarding process to buffer an unbounded amount of that client\u0027s data in memory, for as long as the backend container connection takes to complete \u2014 with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An attacker that can reach a container\u0027s published TCP port may be able to force the host\u0027s forwarding process to buffer an unbounded amount of that client\u0027s data in memory, for as long as the backend container connection takes to complete \u2014 with no cap on how much accumulates or how long the wait can be stretched.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T21:16:08.187Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-64773",
    "datePublished": "2026-08-20T21:16:08.187Z",
    "dateReserved": "2026-07-20T18:10:53.025Z",
    "dateUpdated": "2026-10-19T20:48:44.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted