CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory
Unauthenticated callers can exhaust Apache APISIX worker memory via the batch-requests plugin (CVE-2026-94250).
Apache APISIX 1.3.0 through 3.18.0 is affected by CVE-2026-94250, an unbounded resource-allocation flaw in the batch-requests plugin rated CVSS 4.0 8.2. An unauthenticated caller can drive a gateway worker into an out-of-memory condition when the batch endpoint is publicly exposed. The issue is missing limits or throttling on batch response aggregation. The disclosure does not report observed exploitation.
- CVE-2026-94250 is rated CVSS 4.0 8.2 (high).
- Affects Apache APISIX 1.3.0 through 3.18.0.
- batch-requests plugin lacks limits on response aggregation.
- Unauthenticated callers can OOM a worker if the batch endpoint is public.
- CVEs
- CVE-2026-94250
- Vendors
- Apache Software Foundation
- Products
- Apache APISIX
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94250 | Unauthenticated worker OOM in Apache APISIX batch-requests | 8.2 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 8. 2 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.