# CVE-2026-97362: HFS2 denial of service via hung serving thread

Source: https://junglewise.ai/threats/cve-2026-97362-hfs2-version-2-4-0-and-earlier-contains-a-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97362 · Severity: high · CVSS 7.5 · Published 2026-09-24

HFS2 is a file server that allows users to share files over HTTP. An unauthenticated attacker can send a single crafted request that causes the server to become completely unresponsive and stop serving all clients. The server requires manual restart by an operator to recover and cannot self-heal.

Technologies: [Wgetnz HFS2](https://junglewise.ai/threats/technologies/hfs2). Vendors: [Wgetnz](https://junglewise.ai/threats/vendors/wgetnz).

## Quick answers

**Is CVE-2026-97362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97362 being exploited in the wild.

**How severe is CVE-2026-97362?** High severity, with a CVSS score of 7.5, published 24 September 2026.

**Which products and versions are affected?** Wgetnz HFS2 2.0.0 through 2.4.0.

**Is there a fix for CVE-2026-97362?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97362 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-97362?** Check whether you run Wgetnz HFS2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HFS2 contains an infinite loop vulnerability (CWE-835) triggered by a crafted request that places a serving thread in a busy loop condition with no exit path. The vulnerability is unauthenticated and requires only network access to exploit. A successful exploit causes complete and persistent denial of service to all clients until the HFS2 process is manually restarted.

## Affected products

- wgetnz HFS2 2.0.0 through 2.4.0

## Timeline

- 2026-09-24: disclosed: CVE-2026-97362 published

## References

- [https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md](https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md)
- [https://www.vulncheck.com/advisories/hfs2-unauthenticated-denial-of-service-via-hung-serving-thread](https://www.vulncheck.com/advisories/hfs2-unauthenticated-denial-of-service-via-hung-serving-thread)

## Related threats

- [HFS2 unauthenticated arbitrary file access in template engine](https://junglewise.ai/threats/cve-2026-97360-hfs2-version-2-4-0-and-earlier-contains-an-unauthenticated)
- [HFS2 template injection in multipart upload handler](https://junglewise.ai/threats/cve-2026-97359-hfs2-version-2-4-0-and-earlier-contains-a-template-injection)