HPE iLO 5 JSON dispatcher mutex leak

Executive summary #

HPE's iLO 5 JSON dispatcher service maintains a four-entry global map protected by a mutex. When the map is full, new entries are silently discarded, but the removal path for a non-existent entry returns without releasing the mutex. An attacker who can drive more than four overlapping /json dispatches can therefore leave the mutex permanently held, deadlocking the JSON service and denying service to subsequent requests.

This issue is an instance of CWE-667 (Improper Locking), has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (3.7, Low), and current SSVC vectors of "Exploitation: PoC" and "Technical Impact: Partial."

Technical details #

The affected component is the json_dsp module in the iLO 5 web service. The module wraps generic /json dispatches with an insert/remove pair into a four-entry global map guarded by a mutex. The insert function (FUN_05390040) is best-effort: when all four slots are occupied, it returns without inserting and without error. The remove function (FUN_05390164) locks the mutex, scans the four slots, and on the miss path (index exceeds 3) returns directly without calling the unlock helper. The structurally identical lookup function (FUN_053900d0) correctly unlocks on the same miss path.

The triggering sequence holds four /json dispatches in the map while a fifth dispatch reaches the insert and remove paths. The fifth insert fails silently because the map is full; its later remove misses every slot and returns with the mutex still locked. A request that enters the separate truncated \u parser loop cannot be used for this sequence because it stalls the web service before the fifth dispatch completes. The deciding control-flow difference is:

<i>/* FUN_053900d0 (lookup): miss path unlocks */</i>
if (iVar1 > 3) {
  func_0x06b286f4(DAT_000ad9e0); <i>/* unlock */</i>
  return 0;
}

<i>/* FUN_05390164 (remove): miss path does NOT unlock */</i>
if (iVar1 > 3) {
  return; <i>/* mutex DAT_000ad9e0 left held */</i>
}

Once the mutex is left held, subsequent JSON dispatches remain blocked until the service task is restarted or the device is reset.

Attacker value #

This issue may allow an unauthenticated attacker to deny service to the iLO JSON management interface. The precondition is the ability to induce sufficient concurrent /json traffic to fill the four-entry map and then trigger a removal of an entry that was never inserted. The attack does not require authentication, but it does require the service to process overlapping dispatches; if the service is strictly single-threaded per request, the window does not open. The effect is a persistent denial of JSON service availability until the service task is restarted or the device is reset.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-19: Initial findings discovered and documented
• 2026-07-21: CVE-2026-65208 reserved
• 2026-07-24: Vendor notified
• 2026-07-28: Transferred reserved CVE IDs to HPE for record management
• 2026-10-13: Public disclosure