CVE-2026-55149
nicheUnauthenticated Out-of-Memory Denial of Service in Vouch Proxy before 0.48.0
Vouch Proxy, an SSO/OAuth/OIDC login proxy for Nginx, fails to validate the part count parsed from an attacker-controlled multipart cookie name before passing it to make([]string, numParts) in pkg/cookie/cookie.go. By sending a single unauthenticated request to /validate or /_external-auth-:id with a cookie named like VouchCookie_1of10000000000, an attacker triggers a slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory error, crashing the authentication proxy; repeated requests can sustain the outage. The vulnerable cookie reassembly occurs before JWT validation (JWTCacheHandler and FindJWT), so no account or valid session is required. Impact is limited to availability, reflected by CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and all users behind the proxy lose access to protected services while it is down. No public proof of concept exists and the issue is not in CISA's KEV, so exploitation is not known to have occurred.
What to do: Upgrade Vouch Proxy to 0.48.0 or later, or pull/rebuild the latest image if deployed via Docker. Until patched, block or rewrite requests whose Cookie header contains names matching the VouchCookie_<n>of<m> pattern at Nginx or a WAF to prevent the oversized allocation. Check Vouch Proxy logs for Go runtime 'fatal error: out of memory' events on the /validate and /_external-auth-:id endpoints as evidence of attempted exploitation.
| Vouch Proxy (vouch) Vouch Proxy | all versions prior to 0.48.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
- Weakness
- CWE-789
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.