CVE-2026-47213 Details
Description
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.
A vulnerability in Boxlite versions through 0.8.2 allows for a timeout bypass in the execution of processes within the sandbox. Boxlite is a service that enables users to create virtual machines and run OCI containers to execute untrusted code. The issue arises because the timeout mechanism uses the catchable SIGALRM signal instead of the uncatchable SIGKILL signal. This flaw can be exploited by malicious code to ignore the timeout and continue execution, leading to resource exhaustion in the virtual machine and disrupting the availability of the Boxlite service.
Users can update to Boxlite version 0.8.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6fd5037e18a58fc4644c882e3c581 | [email protected] | Source CodeVendor |
| https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-xjhv-pp2r-6f82 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Boxlite | <= 0.8.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |