HIGH 7.5 GitHub
CVE-2026-55149
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
## Unbounded Multipart Cookie Allocation DoS in vouch-proxy
### Summary
vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The `/validate` endpoint parses the total cookie part count directly from the attacker-controlled cookie name (e.g., `VouchCookie_1of<N>`) and passes it without any bounds check to `make([]string, N)`. A single HTTP request with `N=10000000000` causes the Go runtime to attempt a ~160 GB heap allo
Affected Products
- go/github.com/vouch/vouch-proxy <= 0.47.2
References
- https://github.com/advisories/GHSA-qqff-5854-px68
- https://github.com/vouch/vouch-proxy/security/advisories/GHSA-qqff-5854-px68
- https://github.com/vouch/vouch-proxy/commit/fa18ce30ba50a4863a436acad044c22965329c4f
- https://github.com/vouch/vouch-proxy/releases/tag/v0.48.0
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-20 via GitHub. Affected: go/github.com/vouch/vouch-proxy <= 0.47.2.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.