High, CVSS 7.5GoAmendedPublished
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud getFileURL Endpoint Leads to Remote Denial of Service
CVE-2026-107839 · GHSA-4jfq-pmq9-257h
- Affected
- Go github.com/luskaner/ageLANServer/server < 1.8.2-0.20260809203301-1dd40166a593
- Fixed in
- 1.8.2-0.20260809203301-1dd40166a593· Vendor fix available
- Issue
- The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length (make(i.A, len(req.Names.Data))), with no request body size limit and no cap on the number of array elements anywhere in the request path. Because the default configuration ships with Authentication = 'disabled', any network client can obtain a session through unauthenticated platform login and then send a single crafted request that forces the server to allocate memory proportional to attacker-chosen input. Dynamic testing against an unmodified build confirmed both large memory-amplification growth from a single request and a full server process kill via the kernel OOM killer when a memory-constrained instance received a few concurrent oversized requests. This is a high-severity, pre-authentication (self-registration only) remote denial-of-service…
Recommended action: Upgrade to 1.8.2-0.20260809203301-1dd40166a593 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.