CVE-2026-47213
published 2026-06-10CVE-2026-47213: Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.27%
18.4th percentile
Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| boxlite-ai | boxlite | <= 0.8.2 | — |
| boxlite-ai | boxlite | 0 – 0.8.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BoxLite Timeout denial of service
vuldb·2026-05-30
CVE-2026-47213 [LOW] BoxLite Timeout denial of service
A vulnerability marked as problematic has been reported in BoxLite. Affected is an unknown function of the component Timeout Handler. This manipulation causes denial of service.
The identification of this vulnerability is CVE-2026-47213. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
BoxLite has a Timeout Bypass Vulnerability
ghsa·2026-05-29
CVE-2026-47213 [MEDIUM] CWE-404 BoxLite has a Timeout Bypass Vulnerability
BoxLite has a Timeout Bypass Vulnerability
#### Summary
BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.
#### Details
1. ExecRequest with timeout_ms arrives at Execution service
**File:** `guest/src/service/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-10
Published