Quick answers
- Is CVE-2026-103101 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103101 being exploited in the wild.
- How severe is CVE-2026-103101?
- High severity, with a CVSS score of 8.6, published 30 September 2026.
- Which products and versions are affected?
- Pexip Infinity 30.0 through 40.x before 41.0.
- Is there a fix for CVE-2026-103101?
- A patch was published on 2026-07: Available in versions 38.2, 39.2, 40.1, and 41.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103101 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-103101?
- Check whether you run Pexip Infinity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the web server component due to improper input validation of network-provided data. A remote, unauthenticated attacker can send a specially crafted request to render a Pexip Infinity node inaccessible, constituting a denial-of-service attack on conferencing infrastructure. Pexip has issued patches for versions 38.2, 39.2, 40.1, and 41.0 and later.
Affected products
- Pexip Infinity 30.0 through 40.x before 41.0
Timeline
- 2026-09-30: disclosed
- 2026-07: patched: Available in versions 38.2, 39.2, 40.1, and 41.0 and later