CVE-2026-70616

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1

Description An authenticated user can cause resource exhaustion by sending requests to the 'GET /loading' endpoint using a malicious id query parameter. The issue occurs because the handler lacks a map-lookup validity check and attempts to receive data from a nil channel (a channel that has not been initialized) which blocks indefinitely. Due to the absence of timeouts, context cancellation, and server-side reclamation, each request permanently consumes one goroutine (a lightweight thread managed by the Go runtime), one file descriptor, and approximately 50 kB of memory. This continues until the server reaches its file descriptor limit, causing listener Accept calls to fail and halting all tunnel traffic forwarding for all users.

Recommendations Update boringproxy to a version newer than 0.10.0. As a temporary mitigation, restrict access to the 'GET /loading' endpoint.