CVE-2026-97362 — HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sendin…
Published: 2026-09-24 · CVSS: 8.7 · CVSS 4.0
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7