CVE-2026-16211
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A race condition vulnerability was found in the Hostname Allocation Handler component of the allegro project (up to version bcf65b994ef29fb3fc2e10b660e6288723d5209e) in the AssetLastHostname.increment_hostname function. The attack requires manipulation of the counter argument, is highly complex, and considered difficult to exploit. The exploit has been publicly disclosed and may be used, while the project has not responded to the issue report.
Risk Assessment
The risk for the organization involves potential disruption of hostname allocation due to the race condition, which could lead to data inconsistency or unauthorized access to resources. Due to the high attack complexity, the risk is limited, but the exploit is publicly available.
Recommendation
It is recommended to immediately apply patches or update to a version newer than bcf65b994ef29fb3fc2e10b660e6288723d5209e if available. If no patch is available, restrict access to the AssetLastHostname.increment_hostname function and monitor logs for suspicious manipulation of the counter argument.
Original NVD description (English source)
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.