Executive brief
UBB.threads, a popular forum software, is vulnerable to a denial-of-service attack. An authenticated user can crash the forum or make it unresponsive for everyone else by repeatedly requesting to view user profiles. This exhausts the server's database resources, leading to a complete service outage and preventing legitimate users from accessing the community.
Technical details
UBB.threads is vulnerable to asymmetric resource consumption (CWE-405) in the user profile viewing component. The root cause is inefficient database query handling when processing requests for user profiles on instances with large numbers of registered users. An authenticated attacker can exploit this by sending multiple concurrent requests to view profiles, leading to database resource exhaustion. This results in a complete Denial of Service (DoS) for the entire application. The vulnerability is confirmed in version 7.7.5, and as vendor contact attempts were unsuccessful, no official patch is currently available.
Affected products
- UBB Systems UBB.threads All versions through 7.7.5
Timeline
- 2026-06-18: advisory: Advisory published by CERT.PL
- 2026-06-18: disclosed: Public disclosure via NVD