CVE-2026-55149— Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
Quick assessment
Affected
vouch vouch-proxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vouch Proxy 是一个基于 Nginx 的 SSO 及 OAuth/OIDC 登录解决方案，使用 模块实现认证。在 0.48.0 版本之前， 中的 函数会从攻击者可控的 multipart cookie 名称中解析出“总部分数”，并直接将该值传入 ，而未校验该值是否为正数或是否在合理范围内。访问 或 的请求会依次经过 中的 、 中的 ，以及易受影响的 cookie 重组逻辑（位于 JWT 验证之前），因此无需账号或有效会话即可触发。例如，一个名为 的 cookie 名称会导致尝试分配约 160 GB 的切片
Possible ATT&CK Techniques 1 AI
T1499.001 · OS Exhaustion FloodAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| vouch | vouch-proxy | < 0.48.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55149
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| vouch | vouch-proxy | < 0.48.0 | - |
|
II. Public POCs for CVE-2026-55149
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55149
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55149 (1)
Vendor Advisories for CVE-2026-55149 (1)
Vendor Pages for CVE-2026-55149 (1)
-
🔗 Release v0.48.0 · vouch/vouch-proxy · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-789
-
CVE-2026-20295
Cisco Secure Firewall Management Center and Secure Firewall -
CVE-2026-77410
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded -
CVE-2026-91752
GNU libextractor before 1.15 Stack Overflow via OLE2 -
CVE-2026-53716
Envoy Gateway: Wasm HTTP fetch decompresses gzip without out -
CVE-2026-53717
Envoy Gateway: OCI layer extraction allocates make([]byte, h
V. Comments for CVE-2026-55149
No comments yet