HPE iLO 4/5 truncated JSON unicode escape denial-of-service

Executive summary #

HPE's iLO 4/5 web service uses a custom JSON string parser that falls into an infinite loop when processing unicode escapes that include less than four hexadecimal digits (\u12). A single unauthenticated request to the session-minting endpoint wedges the entire HTTPS management service and the device does not recover until it is power-cycled.

This issue is an instance of CWE-835 (Loop with Unreachable Exit Condition), has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High), and current SSVC vectors of "Exploitation: PoC" and "Technical Impact: Partial."

Technical details #

The affected component is the JSON string parser in the iLO web service, reached without authentication through POST /json/login_session, the endpoint that issues login sessions and is therefore pre-authentication by design. In the string-escape loop of the parser, a \u escape is decoded with sscanf(p, "\u%4x%n", &val, &n) and the cursor advances only when n == 6. For a \u escape with fewer than four hex digits, such as "\u" or "\u12", n is not 6, the advance is skipped, and the enclosing loop reads the same \ and u again without progress. The loop exits only on a closing quote, a NUL, or the output-buffer cap, none of which occur for a truncated escape, so the parser spins. Any string value in the login body, including the user_login or password value, reaches the loop.

The following request triggers the condition. It is destructive: it wedges the target until the unit is power-cycled.

curl -sk -X POST "https://example.lan/json/login_session" \
  -H "Content-Type: application/json" \
  -d '{"method":"login","user_login":"\u12","password":"x"}'

The triggering request receives no response and the connection times out at the client. A well-formed control request with an invalid credential returns promptly:

curl -sk -D - -X POST "https://example.lan/json/login_session" \
  -H "Content-Type: application/json" \
  -d '{"method":"login","user_login":"nope","password":"nope"}'

HTTP/1.1 403 Forbidden
Content-Type: text/plain
Content-Length: 62
Date: Mon, 20 Jul 2026 00:20:07 GMT
Server: HP-iLO-Server/1.30
X-Frame-Options: sameorigin

After the triggering request, every HTTPS endpoint (for example /xmldata?item=all and /redfish/v1/) stops responding; on firmware 2.30 the IPMI responder also fails (Unable to establish IPMI v2 / RMCP+ session) and the SSH banner times out. The unit remains in this state until it is power-cycled.

Attacker value #

This issue may allow an unauthenticated attacker to take the iLO management plane offline until manual intervention. The only precondition is network reachability of the iLO HTTPS port; no credential, session, or user interaction is required. On firmware 2.30 the host cooling fans run at full speed for the duration. The spinning loop does not trip a hardware watchdog and the offending task is not killed, so the outage persists until the management processor is hard power-cycled.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-19: Initial findings discovered and documented
• 2026-07-21: CVE-2026-65207 reserved
• 2026-07-24: Vendor notified
• 2026-07-28: Transferred reserved CVE IDs to HPE for record management
• 2026-10-13: Public disclosure