Read the docs
TI-2018-01174 Aliases CVE-2018-1269GHSA-rq2f-rgc6-gfh9

Improper handling of exceptional conditions in Cloud Foundry Loggregator

Priority LOW 31CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the traffic controller to leave dangling TCP connections, which could cause denial of service.

Why it matters now

EPSS 0.01041 64th percentileScored 2026-11-07
Fix Fixed Loggregator (Cloud Foundry): 89.5, 96.1, 99.1 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud FoundryLoggregator89.x to before 89.5; 96.x to before 96.1; 99.x to before 99.1; 101.x to before 101.9; 102.x to before 102.289.5, 96.1, 99.1, 101.9, 102.2Patch availableCNA
  • Loggregator VendorCloud Foundry Affected 89.x to before 89.5; 96.x to before 96.1; 99.x to before 99.1; 101.x to before 101.9; 102.x to before 102.2 Fixed in 89.5, 96.1, 99.1, 101.9, 102.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:loggregator:*:*:*:*:*:*:*:*89 to before 89.5; 96 to before 96.1; 99 to before 99.1; 101 to before 101.9; 102 to before 102.2VulnerableCloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:loggregator:*:*:*:*:*:*:*:* Versions 89 to before 89.5; 96 to before 96.1; 99 to before 99.1; 101 to before 101.9; 102 to before 102.2 Vulnerable ·CloudFoundry Foundation

Remediation

  • Fix · CNA Loggregator (Cloud Foundry) Fixed in 89.5, 96.1, 99.1, 101.9, 102.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cloud Foundry Loggregator 101.9, 102.2 and 3 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-01173 Improper input validation in Cloud Foundry LoggregatorPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1269
  2. 2026-10-03 Alias added: GHSA-rq2f-rgc6-gfh9

References

Advisory 1

  • TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
  • TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
  • TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
  • TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
  • TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
  • TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences