CVE-2026-55149
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.40%
- CWE
- CWE-789
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- vouch vouch-proxy
Weakness type
Related vulnerabilities
- CVE-2026-25579 — Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
- CVE-2026-5740 — Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server
- CVE-2026-28253 — Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
- CVE-2025-54801 — Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
- CVE-2026-49975 — Apache HTTP Server: mod_http2 denial of service
- CVE-2026-22803 — SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
- CVE-2026-22026 — CryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion
- CVE-2026-82435 — Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder