CVE-2026-47213: Boxlite Sandbox DoS Vulnerability

CVE-2026-47213 Overview

CVE-2026-47213 is a denial-of-service vulnerability in Boxlite, a sandbox service that runs Open Container Initiative (OCI) containers inside lightweight virtual machines to execute untrusted code. Versions 0.8.2 and prior allow users to configure a timeout for services running inside a Box. When the timeout expires, Boxlite terminates the target process by sending SIGALRM instead of the uncatchable SIGKILL. Malicious code inside the sandbox can install a signal handler for SIGALRM and ignore the termination request, continuing to consume CPU, memory, and file descriptors. The flaw is tracked as improper resource shutdown and release [CWE-404].

Critical Impact
Authenticated sandbox tenants can bypass timeout enforcement, exhaust virtual machine resources, and degrade availability of the Boxlite service for all users.

Affected Products

Boxlite versions 0.8.2 and prior
Boxlite sandbox virtual machine (Box) runtime
OCI container workloads launched through Boxlite

Discovery Timeline

2026-06-10 - CVE-2026-47213 published to NVD
2026-06-10 - Last updated in NVD database
Patch commit - Fix delivered in upstream commit 28159fc

Technical Details for CVE-2026-47213

Vulnerability Analysis

Boxlite enforces per-service timeouts to bound the execution of untrusted workloads inside each Box. The timeout subsystem is responsible for stopping a process once its configured duration elapses. Instead of issuing the uncatchable SIGKILL (signal 9), the implementation issues SIGALRM (signal 14), which is fully catchable, blockable, and ignorable from user space.

A process inside the sandbox can register a no-op handler with signal(SIGALRM, SIG_IGN) or sigaction() and survive the timeout indefinitely. Because the host-side enforcement believes the process has been signaled, no escalation to SIGKILL occurs. The vulnerability is scoped to availability only, with no impact on confidentiality or integrity.

Root Cause

The root cause is incorrect signal selection in the timeout handler. SIGALRM is intended for in-process alarm delivery and is expected to be caught by the receiving program. Using it as a termination primitive violates the assumption that the kernel will unconditionally reap the process. The fix in commit 28159fc replaces the catchable signal with SIGKILL, which the kernel delivers without giving the target a chance to intercept it. This is consistent with [CWE-404] improper resource shutdown and release.

Attack Vector

Exploitation requires the ability to submit code to a Boxlite sandbox, which corresponds to the low-privilege authenticated tenant role exposed over the network. An attacker submits an OCI container whose entrypoint installs a SIGALRM handler before performing CPU or memory intensive work. When Boxlite triggers the timeout, the signal is absorbed and the workload continues, exhausting the virtual machine and starving co-tenant services. Repeated submissions amplify the impact across the Boxlite fleet. Technical details are documented in GitHub Security Advisory GHSA-xjhv-pp2r-6f82.

Detection Methods for CVE-2026-47213

Indicators of Compromise

Sandbox processes that remain RUNNING past their configured timeout window
Sustained high CPU or memory utilization inside a Box after a timeout event has been logged
Container entrypoints that invoke signal(), sigaction(), or sigprocmask() against SIGALRM (signal 14)
Repeated Box creations from the same tenant followed by failure to reclaim VM resources

Detection Strategies

Correlate Boxlite timeout events with subsequent process exit events; a missing or delayed exit indicates signal suppression
Inspect submitted container images and entrypoint scripts for handlers that mask or ignore SIGALRM
Track per-VM resource ceilings and alert when usage continues to grow after a documented timeout

Monitoring Recommendations

Forward Boxlite service logs and host audit logs to a centralized analytics platform for correlation across tenants
Emit metrics for timeout_triggered versus process_reaped and alert on divergence
Monitor host-level cgroup accounting on the Boxlite VMs to detect workloads that exceed their declared lifetime

How to Mitigate CVE-2026-47213

Immediate Actions Required

Upgrade Boxlite to the release containing commit 28159fc or later
Audit existing Boxes for long-running workloads that outlived their configured timeout and terminate them out-of-band
Restrict who can submit workloads to Boxlite until the patched version is deployed

Patch Information

The maintainers fixed the issue in commit 28159fc, which replaces the catchable SIGALRM with the uncatchable SIGKILL in the timeout enforcement path. Review the change in the GitHub Commit Changes and the coordinated GitHub Security Advisory GHSA-xjhv-pp2r-6f82. Operators running versions 0.8.2 and prior must update before exposing the service to untrusted tenants.

Workarounds

Enforce hard CPU and memory cgroup limits on each Box so an unreaped process cannot starve the host
Apply a watchdog that issues SIGKILL from the host when a Box exceeds its declared lifetime
Reduce per-tenant concurrency to limit the blast radius of a single non-terminating workload

bash

# Configuration example: host-side watchdog enforcing hard termination
# Kills any Boxlite child process still alive 5 seconds after its declared timeout
TIMEOUT_SECONDS=30
GRACE_SECONDS=5
timeout --signal=SIGKILL \
  --kill-after=${GRACE_SECONDS}s \
  ${TIMEOUT_SECONDS}s \
  boxlite run --image untrusted/workload:latest