High, CVSS 7.5GoAmendedPublished
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
CVE-2026-55149 · GHSA-qqff-5854-px68
- Affected
- Go github.com/vouch/vouch-proxy <= 0.47.2
- Fixed in
- 0.48.0· Vendor fix available
- Issue
- Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie name (e.g., VouchCookie1of<N) and passes it without any bounds check to make([]string, N). A single HTTP request with N=10000000000 causes the Go runtime to attempt a ~160 GB heap allocation, triggering a fatal out-of-memory error that crashes the server process immediately. No authentication or prior session is required. Details The vulnerability exists in pkg/cookie/cookie.go. The Cookie() function iterates over all cookies in the request, identifies multipart cookies by the NofM suffix in their name, and initializes the reassembly slice on the first matching cookie: The value in xyArray[1] comes directly from the cookie name supplied by the client. There is no maximum value check, no…
Recommended action: Upgrade to 0.48.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.