Executive brief
OutSystems Platform Server is a low-code development platform used by enterprises to build and deploy applications. A denial-of-service vulnerability allows attackers to exhaust server resources by sending multiple HTTP requests with mismatched content-length headers, causing the server to hang and become unresponsive to legitimate users. Less than 500 concurrent connections are sufficient to render the entire platform unavailable, affecting both the platform itself and all hosted applications.
Technical details
This is a Slowloris-variant denial-of-service vulnerability (R.U.D.Y: "R U Dead Yet?") in OutSystems Platform Server that exploits improper HTTP request handling. An attacker crafts POST requests with a content-length header value larger than the actual body length; the server hangs indefinitely waiting for the missing bytes rather than timing out. By maintaining multiple concurrent connections with minimal bandwidth consumption, an attacker exhausts connection pools and server resources. The vulnerability affects the default IIS webserver configuration bundled with the platform. No official patch is available; the vendor has been unable to reproduce the issue despite disclosure attempts.
Affected products
- OutSystems Platform Server 11.18.1.37828
Timeline
- 2025-09: disclosed: Vulnerability discovered during penetration testing and reported to customer
- 2025-09: advisory: Submitted to MITRE CVE program
- 2025-12-09: other: Public disclosure via Balwurk security research