Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/crowdsecurity/crowdsec >= 1.5.0, <= 1.7.7
Fixed in
1.7.8· Vendor fix available
Issue
The CrowdSec AppSec component fails to read the HTTP request body for any request whose Content-Length is not positive — most notably HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests sent without a content-length header. Coraza is then evaluated against an empty body, so every WAF rule targeting REQUESTBODY, BODYARGS, ARGSPOST, JSON, or XML silently fails to match. An unauthenticated remote attacker can bypass the entire AppSec body-inspection pipeline by changing a single framing header on an otherwise-malicious request. The bypassed request is forwarded as allow and produces no WAF log entry. Affected versions - github.com/crowdsecurity/crowdsec — all releases up to and including v1.7.7. Affected component pkg/appsec/request.go, function NewParsedRequestFromRequest. Root cause Go's net/http server sets r.ContentLength = -1 when the request uses Transfer-Encoding: chunked with no Content-Length header, or when an HTTP/2 request omits the content-length…
Recommended action: Upgrade to 1.7.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/crowdsecurity/crowdsec >= 1.7.0, < 1.7.8
Fixed in
1.7.8· Vendor fix available
Issue
The LAPI router uses gin-contrib/gzip with DefaultDecompressHandle globally (pkg/apiserver/controllers/controller.go). This middleware decompresses incoming request bodies without enforcing a maximum decompressed size. The endpoints /v1/watchers or /v1/watchers/login require no authentication. An attacker can send small gzip-compressed JSON payloads that, when decompressed, result in hundreds of MB of valid JSON occupying server memory. Sending enough requests concurrently will cause LAPI to allocate excessive heap memory, leading the OS to forcibly terminate the process. This vulnerability is not exploitable from the network in default configurations, as LAPI only listens on the loopback interface. If developers' applications are using a multi-server setup, LAPI will be exposed in the network, in which case they are at risk if untrusted IPs can access it. Impact Exploiting this vulnerability will make LAPI unreachable, meaning that bouncers will not be able to fetch new decisions…
Recommended action: Upgrade to 1.7.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.