Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54716— Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Quick assessment

Affected
valhalla valhalla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Valhalla 是一款用于处理 OpenStreetMap 数据的开源路径引擎及其配套库。在 3.7.0 及更早版本中，向 端点发送一个 POST 请求，若其中包含由三个共线点构成的 多边形环，可能导致工作进程出现无限内存增长。由于这种零面积几何体（而非其他请求参数）会触发 中的处理逻辑，直至进程被系统的内存不足（OOM）杀手终止。因此，单个未认证请求即可导致面向公众的工作进程停止服务。其他接受 参数的端点（如 ）尚未被验证是否受影响。截至本次评估时，尚无修复版本发布。

CVSS 7.5 · High EPSS 0.46% · P40

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
valhalla valhalla <= 3.7.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54716

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets
Source: CVE Program / CVE List V5
Vulnerability Description
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
valhalla valhalla <= 3.7.0 -

II. Public POCs for CVE-2026-54716

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54716

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-54716 (1)

IV. Related Vulnerabilities

Same product: valhalla
Same vendor: valhalla
Same weakness: CWE-770