Resource Exhaustion Vulnerability in Boxlite by Boxlite AI
CVE-2026-47213

6.5MEDIUM

Key Information:

Vendor

Boxlite-ai

Status
Boxlite
Vendor
CVE Published:
10 June 2026

What is CVE-2026-47213?

Boxlite, a sandbox service that facilitates the creation of lightweight virtual machines to run untrusted code, has a vulnerability in versions 0.8.2 and earlier. The platform allows users to set a timeout for processes running in its virtual environment. When this timeout is reached, Boxlite attempts to terminate the process. However, the mechanism employed for this termination does not use the uncatchable SIGKILL signal but the catchable SIGALRM signal. As a result, malicious actors can exploit this flaw to prevent the termination of their code, leading to resource exhaustion in the virtual machine, which may significantly impact the availability and performance of the Boxlite service. The issue has been resolved in a recent patch.

Affected Version(s)

boxlite <= 0.8.2

References

https://github.com/boxlite-ai/boxlite/security/advisories...
x_refsource_CONFIRM
https://github.com/boxlite-ai/boxlite/commit/28159fc5b6b6...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.