{"id":"CVE-2026-6060","aliases":["EUVD-2026-23933","GHSA-pcwm-7778-9vqh","UBUNTU-CVE-2026-6060"],"status":"published","title":"Possible DoS via SQL Box","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.3.X","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00191,"percentile":0.0879,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-400","CWE-770"],"published":"2026-04-20T18:20:01Z","modified":"2026-10-17T12:56:00Z","exploits":[{"source":"pocgithub","id":"George0Papasotiriou/CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass","title":"George0Papasotiriou/CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass","date":"2026-08-03","url":"https://github.com/George0Papasotiriou/CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10-1","5.0.1-1","5.0.1-2","5.0.2-1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.23-1","5.0.24-1","6.0.1-1","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.20-1","6.0.23-2","6.0.24-1","6.0.25-1","6.0.25-2","6.0.25-3","6.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.32-6","6.1.2-1","6.2.1-1","6.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.3-1","6.5.4-1","6.5.5-1","6.5.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.14-1","6.5.15-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.18-1","6.5.20-1","6.5.21-1","6.5.22-1","6.5.23-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.15-2","6.5.18-1"]}],"products":[{"vendor":"otrs ag","product":"otrs"}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-01/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6060"},{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-01"},{"url":"https://github.com/advisories/GHSA-pcwm-7778-9vqh"},{"url":"https://ubuntu.com/security/CVE-2026-6060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6060","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-6060","title":"Possible DoS via SQL Box","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.3.X","status":"published","published":"2026-04-20T18:20:01.664Z","modified":"2026-04-20T18:48:48.185Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-23933","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.3.X","status":"published","published":"2026-04-20T18:20:01Z","modified":"2026-04-20T18:48:48Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:24:22.012341Z"}],"ghsa":[{"id":"GHSA-pcwm-7778-9vqh","title":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource...","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.3.X","status":"published","published":"2026-04-20T21:31:44Z","modified":"2026-04-20T21:31:45Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:07:33.597532Z"}],"nvd":[{"id":"CVE-2026-6060","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.3.X","status":"published","published":"2026-04-20T19:16:11.043Z","modified":"2026-06-17T11:00:15.26Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"UBUNTU-CVE-2026-6060","description":"A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS:   *  7.0.X   *  8.0.X   *  2023.X   *  2024.X   *  2025.X   *  2026.X before 2026.3.X","status":"published","published":"2026-04-20T19:16:00Z","modified":"2026-10-17T12:56:00.526735254Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"}]}}