How severe is CVE-2024-6598?

CVE-2024-6598 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-6598 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-6598?

CVE-2024-6598 affects Knime Business Hub. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-6598?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-6598 have an EU (EUVD) identifier?

Yes. CVE-2024-6598 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47662.

When was CVE-2024-6598 published?

CVE-2024-6598 was published on 2024-07-09 and last updated on 2026-06-17.

CVE-2024-6598

CVE-2024-6598 is a medium-severity vulnerability in Knime Business Hub with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-770.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.1
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-47662
Weakness: CWE-770
Affected product: Knime Business Hub
Published: 2024-07-09
Last modified: 2026-06-17

Description

A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation. Updating to KNIME Business Hub 1.10.2 or later solves the problem.

Frequently asked questions

What is CVE-2024-6598?: A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation. Updating to KNIME Business Hub 1.10.2 or later solves the problem.
How severe is CVE-2024-6598?: CVE-2024-6598 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-6598 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-6598?: CVE-2024-6598 affects Knime Business Hub. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-6598?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-6598 have an EU (EUVD) identifier?: Yes. CVE-2024-6598 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47662.
When was CVE-2024-6598 published?: CVE-2024-6598 was published on 2024-07-09 and last updated on 2026-06-17.

References

https://www.knime.com/security/advisories#CVE-2024-6598

Affected products (1)

cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*

More vulnerabilities in Knime Business Hub

CVE-2025-2787 — High (CVSS 8.8): KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which…
CVE-2025-2402 — High (CVSS 8.6): A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones…
CVE-2025-11240 — High (CVSS 7.2): An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote…
CVE-2025-3019 — High (CVSS 7.2): KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a…
CVE-2023-2541 — Medium (CVSS 5.3): The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about…
CVE-2025-14262 — Medium (CVSS 4.3): A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of…

All CVEs affecting Knime Business Hub →

Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities

CVE-2026-31283 — Critical (CVSS 9.8): In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email…
CVE-2020-37067 — Critical (CVSS 9.8): Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers…
CVE-2021-47875 — Critical (CVSS 9.8): GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the…
CVE-2025-11832 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access…
CVE-2024-44241 — Critical (CVSS 9.8): The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia…
CVE-2022-3439 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.

Browse all CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities →