CVE-2026-70616
Received Received - Intake

Resource Exhaustion in boringproxy via Malicious GET Requests

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70616
EUVD
EUVD-2026-53598

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boringproxy boringproxy to 0.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-833 The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in boringproxy through 0.10.0 allows authenticated users to exhaust server resources by sending requests to the GET /loading endpoint with attacker-controlled id query parameters. The server fails to validate these parameters, causing it to block indefinitely on a nil channel without timeouts or context cancellation. Each malicious request permanently consumes one goroutine, one file descriptor, and about 50 kB of memory until the server's file descriptor limit is reached, halting all tunnel traffic forwarding.

Detection Guidance

Monitor for excessive goroutines, file descriptors, or memory usage on the boringproxy server. Check for blocked HTTP server Accept calls due to exhausted file descriptors. Use system tools like 'lsof' to count open file descriptors or 'ps' to inspect process resource usage.

Impact Analysis

If you use boringproxy through 0.10.0, an attacker with valid credentials could crash your server by sending specially crafted requests. This would disrupt all tunnel traffic forwarding for all users, making the service unavailable until manually restarted or the server is rebooted.

Compliance Impact

This vulnerability could lead to service disruption, potentially violating availability requirements in GDPR and HIPAA. Downtime may result in unauthorized access to data or failure to provide timely access to protected information, risking compliance penalties.

Mitigation Strategies

Upgrade boringproxy to a patched version if available. Implement rate limiting on the /loading endpoint. Add timeouts to HTTP server configurations to prevent indefinite blocking. Restrict authenticated user access to prevent abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart