Skip to content
NewA calmer, faster ZeroHour
Vulnerability5 · 3 reads

CVE-2026-94250

Unauthenticated worker OOM in Apache APISIX batch-requests

CVSS 4.0
8.2 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-94250 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache APISIX 1.3.0 through 3.18.0 has an allocation-of-resources-without-limits flaw (CWE-770) in the batch-requests plugin. An unauthenticated remote caller can hit a publicly exposed batch endpoint on a route that uses the plugin and drive a gateway worker into out-of-memory failure. Impact is loss of availability for that worker (CVSS 4.0 8.2); confidentiality and integrity are not affected. Only deployments that enable batch-requests and expose the batch endpoint are in scope. No public proof of concept is known and the issue is not in CISA KEV; 3.19.0 fixes it.

What to do: Upgrade Apache APISIX to 3.19.0. Until then, disable the batch-requests plugin or stop exposing its batch endpoint on public routes, and watch gateway worker memory for exhaustion.

ProductAffected
Apache Software Foundation Apache APISIX1.3.0 through 3.18.0
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Weakness
CWE-770
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story