Unauthenticated DoS Flaw Hits gocsaf csaf_provider Up to 3.6.0

The gocsaf Development Community csaf_provider product contains a resource management flaw. Versions up to and including 3.6.0 are vulnerable to remote denial-of-service attacks that require no authentication.

What happened

The National Vulnerability Database records CVE-2026-107564 as a high-severity issue with a CVSS score of 8.7. The flaw stems from a failure to limit or throttle resource allocation within the software. An unauthenticated remote attacker can exploit this weakness to trigger excessive CPU load. This resource exhaustion leads to a denial-of-service condition for the affected system.

The vulnerability is classified under CWE-770, which covers allocation of resources without limits or throttling. The issue affects the csaf_provider component maintained by the gocsaf Development Community. Any deployment running version 3.6.0 or earlier is considered impacted by this specific defect.

Why it matters

Systems running the affected versions of csaf_provider are exposed to remote disruption. Attackers do not need valid credentials to initiate the denial-of-service condition. The ability to cause high CPU load remotely means network-facing instances are at direct risk.

For IT managers, the unauthenticated nature of the exploit removes a primary barrier to entry. The high CVSS score reflects the ease of exploitation and the impact on availability. Organizations must verify their current version against the vulnerable range immediately.

What to watch

• Monitor system logs for sudden spikes in CPU utilization
• Check for unauthorized access attempts on network interfaces
• Verify current software versions against the vulnerable list
• Look for signs of service unavailability or slow response times

Who needs to act first

Teams should prioritize updating externally facing systems that host the vulnerable software. Exposed servers present the highest risk because attackers can reach them without authentication. Administrators should back up current configurations before applying any changes. Testing updates in a staging environment helps prevent service disruption during the rollout. If immediate patching is not possible, restrict network access to the affected services. This reduces the attack surface while a permanent fix is prepared.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: gocsaf

• Inventory all systems running gocsaf csaf_provider to identify vulnerable versions
• Isolate affected servers from public networks if an update is not immediately available
• Monitor system performance metrics for unusual CPU spikes indicating an attack
• Await vendor guidance for a patch once the developer releases a fix

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of csaf_provider are affected by CVE-2026-107564?

All versions up to and including 3.6.0 are affected.

Is a patch available for this vulnerability?

No fix has been confirmed yet.

What is the CVSS score for this flaw?

The National Vulnerability Database rates it as 8.7 HIGH.