HPE NonStop HTTP Server Flaw Can Cause System Halts in Affected Versions
A high-severity memory corruption flaw in HPE NonStop HTTP Webserver versions T1144L24^AAL and earlier can cause system halts, requiring inventory checks.
Key points
- The vulnerability is tracked as CVE-2026-79829 with a CVSS score of 8.2.
- It affects HPE NonStop HTTP WEBSERVER version T1144L24^AAL and all earlier builds.
- The National Vulnerability Database classifies the issue as a high-severity risk.
Hewlett Packard Enterprise NonStop HTTP WEBSERVER versions T1144L24^AAL and earlier contain a security vulnerability that can lead to memory corruption. According to the National Vulnerability Database, this flaw is rated as high severity with a CVSS score of 8.2. The issue is tracked under identifier CVE-2026-79829 and falls under weakness category CWE-20. Organizations must determine if their environments run these specific server versions.
How it unfolded
- The National Vulnerability Database published a record for CVE-2026-79829 detailing the memory corruption issue.
- The entry specifies that the flaw exists in HPE NonStop HTTP WEBSERVER T1144L24^AAL and earlier versions.
- The database assigns a CVSS score of 8.2, categorizing the risk level as high for affected systems.
Who is affected
Organizations running HPE NonStop HTTP WEBSERVER are exposed if they have not upgraded beyond version T1144L24^AAL. The National Vulnerability Database explicitly lists this version and all prior releases as vulnerable. The core issue involves memory corruption within the web server component. This corruption can result in a complete system halt, disrupting service availability for any applications relying on this web server infrastructure.
Our take on the response
The current public record from the National Vulnerability Database describes the technical impact but does not confirm the availability of a vendor patch. For managed service providers, this creates a period of uncertainty. Without a confirmed fix, the immediate priority is containment and inventory. Teams must verify whether their managed HPE NonStop environments are running the affected versions. If no update is available, reducing the attack surface becomes the primary mitigation strategy until the vendor releases a resolution.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks when addressing high-severity flaws. Check whether your client environments host the affected HPE NonStop HTTP WEBSERVER versions in public-facing zones. Isolate these systems from general network traffic if possible. Validate that logging is active to detect unusual behavior. Back up configuration files before making any changes. Reduce exposure by restricting access to the web server interface until a vendor update is confirmed and tested in a safe environment.
What to do and how to stay safe: HPE
- Audit all managed HPE NonStop servers to identify instances running version T1144L24^AAL or earlier.
- Restrict network access to the affected HTTP WEBSERVER to trusted IP addresses only.
- Monitor system logs for signs of memory corruption or unexpected service interruptions.
- Await official vendor guidance before applying unverified workarounds or configuration changes.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-79829?
The National Vulnerability Database assigns a CVSS score of 8.2 to this vulnerability.
Which HPE NonStop HTTP WEBSERVER versions are affected?
Version T1144L24^AAL and all earlier versions are affected by this security flaw.
What is the potential impact of this vulnerability?
The vulnerability can cause memory corruption which may result in a system halt.
