Threat Advisory

Vouch Proxy Flaw Fails Server Via Uncontrolled Split Cookie Handling

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

CVE-2026-55149, with a CVSS score of 7.5, is a vulnerability in vouch/vouch-proxy that allows an attacker to crash the server process by sending a GET request to /validate with a cookie containing a large number of parts. The multipart-cookie reassembly routine reads the total part count from the attacker-controlled cookie name and calls make(string, N) without any upper-bound check. This forces the Go runtime to attempt a large heap allocation, triggering an immediate out-of-memory fatal error and crashing the server process. The vulnerability can be exploited by sending a crafted HTTP request containing an excessively large cookie part count. The significance of this vulnerability lies in its ability to cause a denial-of-service (DoS) attack against the vouch-proxy server, which can impact organizations relying on the service for authentication and authorization functions.[/subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

CVE-2026-55149, with a CVSS score of 7.5, is a vulnerability in vouch/vouch-proxy that allows an attacker to crash the server process by sending a GET request to /validate with a cookie containing a large number of parts. The multipart-cookie reassembly routine reads the total part count from the attacker-controlled cookie name and calls make(string, N) without any upper-bound check. This forces the Go runtime to attempt a large heap allocation, triggering an immediate out-of-memory fatal error and crashing the server process. The vulnerability can be exploited by sending a crafted HTTP request containing an excessively large cookie part count. The significance of this vulnerability lies in its ability to cause a denial-of-service (DoS) attack against the vouch-proxy server, which can impact organizations relying on the service for authentication and authorization functions.[emaillocker id="1283"]

 

RECOMMENDATIONS:

  • We recommend you to update github.com/vouch/vouch-proxy to version 0.48.0 or later.

 

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-qqff-5854-px68

[/emaillocker]
crossmenu