CVE-2026-115793 Details
Description
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
A resource exhaustion vulnerability has been identified in P-Net versions prior to 1.0.3. The issue arises because the software fails to release RPC sessions allocated for requests that reference unknown interfaces or object UUIDs. Additionally, it does not initiate a timeout for these sessions. As a result, repeated requests with different activity UUIDs can deplete the available RPC sessions. Once all sessions are exhausted, the device stops responding to new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. This vulnerability can be exploited by a remote, unauthenticated attacker to cause a denial-of-service condition.
Users are advised to upgrade to P-Net version 1.0.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-772 | Missing Release of Resource after Effective Lifetime | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Affected Products
| Product | Versions |
|---|---|
| P-Net | < 1.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |