Halo versions 2.22.4 and earlier are susceptible to a denial of service vulnerability that allows unauthenticated remote attackers to disrupt service availability.

The vulnerability exists within the public comment submission endpoint, which fails to properly validate inputs, allowing an unauthenticated attacker to trigger a denial of service condition.

The ability for an unauthenticated attacker to cause a denial of service poses a significant risk to site availability and operational continuity. With a CVSS score of 7.5, this high-severity flaw could lead to service outages, potentially impacting user engagement and overall system performance.

Immediate Action: Review the provided references for vendor-specific guidance or patches; if no official patch is available, consider disabling the public comment submission feature.

Proactive Monitoring: Monitor server resource utilization and access logs for unusually large or malformed requests directed at the comment submission endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to inspect and filter suspicious payloads targeting the comment submission API.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub (https://github.com/HowieHz/CVE-2025-70886).

Given the availability of a public proof-of-concept and the ease of exploitation, administrators should prioritize securing the affected endpoint immediately. If an official update is not yet available, implement defensive filtering or disable the vulnerable commenting functionality until a permanent fix can be applied to maintain system stability.