EXECUTIVE SUMMARY:
CVE-2026-55149, with a CVSS score of 7.5, is a vulnerability in vouch/vouch-proxy that allows an attacker to crash the server process by sending a GET request to /validate with a cookie containing a large number of parts. The multipart-cookie reassembly routine reads the total part count from the attacker-controlled cookie name and calls make(string, N) without any upper-bound check. This forces the Go runtime to attempt a large heap allocation, triggering an immediate out-of-memory fatal error and crashing the server process. The vulnerability can be exploited by sending a crafted HTTP request containing an excessively large cookie part count. The significance of this vulnerability lies in its ability to cause a denial-of-service (DoS) attack against the vouch-proxy server, which can impact organizations relying on the service for authentication and authorization functions.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-55149, with a CVSS score of 7.5, is a vulnerability in vouch/vouch-proxy that allows an attacker to crash the server process by sending a GET request to /validate with a cookie containing a large number of parts. The multipart-cookie reassembly routine reads the total part count from the attacker-controlled cookie name and calls make(string, N) without any upper-bound check. This forces the Go runtime to attempt a large heap allocation, triggering an immediate out-of-memory fatal error and crashing the server process. The vulnerability can be exploited by sending a crafted HTTP request containing an excessively large cookie part count. The significance of this vulnerability lies in its ability to cause a denial-of-service (DoS) attack against the vouch-proxy server, which can impact organizations relying on the service for authentication and authorization functions.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-qqff-5854-px68