On Wed, Aug 12, 2026 at 03:15:52PM +0200, Brett A C Sheffield wrote:
On 2026-08-12 13:47, Howard Chu wrote:
Windl, Ulrich wrote:
So a DoS (Denial of Service) (e.g. by crashing the app from remote) is not a security issue?
It does not allow remote code execution, privilege escalation, or privileged data exfiltration. So no, it is not a security issue.
That's an extraordinary position to take.
Remotely stopping code execution certainly gives the attacker something they did not have. Being able to remotely stop your systems from operating at will, with all the associated revenue loss and other impacts that may have may well allow an attacker to achieve their aims completely.
There are three impact categories for CVEs: confidentiality, integrity and availability. Are you really saying that ceding control over availability to an attacker is not a security issue? Being able to, say, shut down a rival phone company at will by killing their directory service seems like a security concern.
You asked for feedback, and I think you should reconsider this. A DoS is a security issue as far as most of the software industry is concerned. Less serious than RCE or LPE, but still of value to an attacker.
Hi Brett, I think you're confusing a critical bug and a vulnerability. An anonymous user being able to bring a server down is clearly the former but not latter, just like a hypothetical critical replication bug which clearly needs no CVE. We're not going to stop people from flagging it as private as mentioned in the preamble.
I agree that a tweak to clarify this is worth making. There might be a way to adjust the description that outlines that distinction yet does not suggest we encourage the perverse incentives of finding literally any bug and insisting it is a vulnerability which is really happening. If you have a suggestion, we're more than happy to adjust, that's the reason we proposed this here first before it lands on the website and maybe repo at some point.
Regards,