CVE-2026-56455
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive.
Risk Assessment
The risk is the possibility of a DoS attack that can disrupt the DFXAnalytics system, leading to service unavailability and potential operational losses.
Recommendation
It is recommended to implement comprehensive input length validation on both the client and server sides to prevent buffer overflow.
Other vulnerabilities in HCL DFXAnalytics
See all- CVE-2026-56456Medium
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application leaks sensitive information about its internal file structure through unhandled errors, logs, or debug output, allowing a remote attacker to map the server environment.
- CVE-2026-56454Medium
HCL DFXAnalytics uses deprecated TLS 1.0 and TLS 1.1 protocols, which have numerous cryptographic flaws. This allows interception and decryption of transmitted data.
- CVE-2026-56453Medium
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter HTTP responses to bypass authentication and authorization controls, gaining unauthorized access to user accounts.
- CVE-2026-35145Low
HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.
- CVE-2026-35143Low
The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
- CVE-2026-35142Low
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
- CVE-2026-35141Low
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. A remote attacker can intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access.
- CVE-2026-35140Low
HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
Original NVD description (English source)
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.