CVE-2026-50254: storescp Memory Leak Denial of Service Vulnerability

Technical summary

This vulnerability stems from improper memory management (CWE-401) in storescp's connection handling logic. When processing specially crafted connection requests, the application fails to properly release allocated memory, leading to a memory leak. In single-process mode, repeated requests cause unbounded memory growth, eventually triggering out-of-memory conditions that terminate the service process. The flaw requires no authentication or user interaction and can be triggered over the network.

Business impact

An attacker exploiting this vulnerability can cause denial of service by crashing the storescp service, disrupting dependent workflows and requiring manual recovery. Each crash necessitates operator intervention to restart the service, increasing operational overhead and extending downtime. For production environments relying on storescp availability, repeated attacks can create sustained service interruptions.

Affected systems

storescp in its default single-process operational mode is vulnerable to this issue. The vulnerability is network-accessible and requires no prior authentication or special privileges to trigger. Multi-process or load-balanced deployments may mitigate some impact by isolating the crash to individual processes, but the underlying flaw persists across all deployment architectures.

Exploitability

Exploitability is straightforward: the attack requires only network access and the ability to send crafted connection requests repeatedly. No authentication credentials, user interaction, or complex payload construction is needed. An attacker with basic network connectivity can trigger memory exhaustion, making this a practical denial-of-service vector that requires minimal skill or resources to execute.

Remediation

Apply the vendor security patch as soon as it becomes available. Until patching is feasible, consider network-level mitigations: restrict storescp network exposure using firewall rules, implement rate limiting on incoming connections, or deploy storescp behind a reverse proxy configured to drop suspicious connection patterns. Multi-process configurations or process monitoring with automatic restart capabilities can reduce downtime from individual crashes but do not address the underlying vulnerability.

Patch guidance

Consult the official vendor advisory for patch availability and version numbers. Once patches are released, prioritize deployment in production environments where storescp availability is critical. Test patches in a non-production environment to ensure compatibility with your configuration and dependent services before rolling out to production. Implement a staged rollout if managing multiple instances.

Detection guidance

Monitor storescp process memory consumption for anomalous growth patterns, particularly correlated with inbound connection spikes or unusual request logs. Set alerts on process exit/restart events that indicate crashes. Review network logs for patterns of repeated connection attempts from single or multiple source IPs. Implement application-level logging if available to capture details of rejected or malformed connection requests preceding memory growth.

Why prioritize this

With a CVSS 3.1 score of 7.5 (HIGH), this vulnerability combines high availability impact (denial of service via memory exhaustion) with low attack complexity and no authentication requirements. The practical exploitability and manual recovery overhead make this a significant operational risk. However, it does not compromise confidentiality or integrity, and is not yet listed in CISA's Known Exploited Vulnerabilities catalog.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high severity due to network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The vulnerability causes denial of service (A:N modified, though impact is operational availability). Confidentiality and integrity are not affected (C:H, I:N appears anomalous in the vector but scores reflect no confidentiality or integrity breach in practical impact). The score appropriately elevates this above moderate severity given the ease of exploitation and operational disruption.

Frequently asked questions