CVE-2026-105792

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9

Description The '/api/task result/{task name}' endpoint calls the get result by task() function in ufo/server/services/session manager.py, which acquires a non-reentrant lock. When the task name maps to a session, it subsequently calls the get result() function, which attempts to acquire the same lock again. An authenticated caller who knows or creates a mapped task name can cause the request to block indefinitely. In the default single-process server configuration, this blocks the event-loop thread, preventing other HTTP, WebSocket, and dependent background interactions.

Recommendations Update to version 3.0.9.