Medium severity · published Oct 24, 2026
CVE-2026-115971
Travisun Opptrix preParsing handler webhook Buffer.concat denial of service
New
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opptrix · Travisun
0.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115971
drive.google.com
https://drive.google.com/drive/folders/1-crbh2joNwFbpXSQ4Iz1U0dSPy4ZTSf_?usp=sharing
vuldb.com
https://vuldb.com/cve/CVE-2026-115971
vuldb.com
https://vuldb.com/submit/992175
vuldb.com
https://vuldb.com/vuln/426052
vuldb.com
https://vuldb.com/vuln/426052/cti
More from Opptrix
7.3
CVE-2026-115970
Travisun Opptrix Import Endpoint import code injection
7.3
CVE-2026-115969
Travisun Opptrix Schedule API setup command injection
