CVE-2026-55149

Name of the Vulnerable Software and Affected Versions vouch-proxy version 0.47.2

Description An unauthenticated remote denial-of-service issue exists in the multipart cookie reassembly logic. The /validate and / external-auth-:id endpoints parse the total cookie part count directly from the cookie name (e.g., VouchCookie 1of<N>) and pass this value to the make() function without bounds checking. An attacker can send a single HTTP request with a very large value for N, forcing the Go runtime to attempt a massive heap allocation, which triggers a fatal out-of-memory error and crashes the server process immediately. This occurs before any authentication or JWT validation is performed.

Recommendations For version 0.47.2, implement a strict upper bound and format validation for the cookie part count before memory allocation. As a temporary mitigation, restrict access to the /validate and / external-auth-:id endpoints to trusted networks to minimize the risk of exploitation.