CVE-2026-96609 Details

A memory exhaustion vulnerability has been identified in Robur Albatross versions 1.0.0 through 2.7.1. The issue arises in the albatross-console, which fails to properly manage the ring buffer used for logging console messages from unikernels. This flaw creates an infinite loop with no termination condition, leading to denial-of-service by exhausting available memory. The vulnerability can only be exploited by users who have permission to send console subscription commands to unikernels that generate enough log output to fill the ring buffer, which has a capacity of 1024 lines. Unauthorized clients cannot exploit this vulnerability.

Users can upgrade to Robur Albatross version 2.7.2 or later, where this vulnerability has been fixed.