Security Advisory: CVE-2026-108082¶
Summary¶
CEP contains a regular-expression denial-of-service vulnerability in HTTP request handling. A crafted Cache-Control header can cause excessive CPU consumption while CEP processes an incoming request.
CEP processes the affected header before routing or authentication. An unauthenticated remote client can therefore cause service degradation or denial of service when the CEP endpoint is network-accessible and the header reaches the application.
Severity¶
High — CVSS 4.0: 8.7
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
The impact is denial of service through CPU exhaustion. No confidentiality or integrity impact is identified in the upstream advisory.
Affected Versions¶
All CEP versions earlier than 1.17.6 are affected.
Fixed Version¶
The issue is fixed in CEP 1.17.6 and later.
Recommendation¶
Upgrade to CEP 1.17.6 or later. For deployments using an exact image tag, update the tag and recreate the container. For deployments using a floating tag, pull the updated image before recreating the container. See the Upgrade Guide.
Temporary Mitigation¶
The upstream advisory documents the vulnerability and its fix, but does not validate a configuration workaround. If an immediate upgrade is not possible, restrict network access where feasible. Ingress rate limiting may reduce repeated abuse, but does not prevent CPU exhaustion from a single crafted request.
If compatible with the application, a trusted ingress proxy could remove all inbound Cache-Control headers before forwarding requests. This should prevent the affected parsing path only if the proxy reliably removes the header; it changes request caching behavior and must be tested. Treat these as temporary, unvalidated risk-reduction measures, not as a substitute for upgrading.