Product:
ColdFusion
Summary
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.4 | CVE-2026-27307 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can send specially crafted requests to the ColdFusion application over an adjacent network. By continuously sending these requests, the attacker can exhaust system resources, leading to a denial-of-service condition. This can significantly degrade application performance without any need for user interaction.
Affected Products
- ColdFusion 2023.18: Affected by resource consumption issues leading to potential denial-of-service.
- ColdFusion 2025.6: Similar vulnerabilities present, allowing for resource exhaustion.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Adobe for ColdFusion. Additionally, monitoring system resources and implementing rate limiting on incoming requests can help reduce the risk of exploitation.