Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
cf-cli can be forced to consume excessive CPU
published 5 months ago
Summary
Versions of the Cloud Foundry command line tool before 8.7.11‑6 can be made to spend a long time processing specially crafted public keys, slowing down the system. This happens when an unauthenticated client sends an unusually large RSA or DSA key during authentication. Upgrade cf-cli to version 8.7.11‑6 or later to apply the built‑in limits that stop the slowdown.
What to do
- Update azure cf-cli to version 8.7.11-6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | cf-cli |
< 8.7.11-6 Fix: upgrade to 8.7.11-6
|
Original advisory text
CVE-2026-39829 affecting package cf-cli for versions less than 8.7.11-6
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
References
Timeline
Published22 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-87468 · OSV
Track software like this
Free during beta