CVE-2026-55149
Received Received - Intake

Memory Exhaustion in Vouch Proxy Cookie Parsing

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55149
EUVD
EUVD-2026-78827

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vouch_proxy vouch_proxy 0.48.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx. Prior to version 0.48.0, a flaw in the cookie parsing function allows an attacker to craft a malicious multipart cookie name that causes an excessive memory allocation. The vulnerability occurs when the cookie name specifies an extremely large number of parts, leading to a fatal out-of-memory condition in the Go runtime.

Detection Guidance

This vulnerability can be detected by monitoring for unusually large cookie values or excessive memory usage in the Vouch Proxy process. Check logs for requests with malformed cookie names containing 'of' followed by large numbers. Use system monitoring tools like 'top' or 'htop' to observe memory consumption spikes in the Vouch Proxy process.

Impact Analysis

This vulnerability can crash the Vouch Proxy authentication service with a single request, causing denial of service. Repeated exploitation can sustain unavailability of the authentication proxy, preventing legitimate users from logging in. No valid account or session is required for exploitation.

Mitigation Strategies

Immediately upgrade Vouch Proxy to version 0.48.0 or later to patch the vulnerability. If upgrading is not immediately possible, consider temporarily disabling the affected endpoints or implementing network-level protections to block malformed cookie requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart