CVE-2026-33257

CVE-2026-33257 is a denial of service vulnerability in an internal web server that permits unlimited memory allocation through specially crafted web requests. The vulnerability affects systems with the internal web server enabled, though this component is disabled by default. The vulnerability carries a CVSS score of 5.3 (MEDIUM) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, meaning exploitation is straightforward. The impact is limited to availability, as the attack causes service disruption through resource exhaustion rather than compromising confidentiality or integrity. There is no current evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities catalog, and community attention remains minimal, with an EPSS score of 0.000090000 indicating very low real-world exploit probability. No public exploit code has been reported, and the vulnerability remains inactive on threat intelligence lists.