CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.

• CWE-770

• https://github.com/valhalla/valhalla/security/advisories/GHSA-qpf6-xp29-pg6r

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54709Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-5471A vulnerability was detected in Investory Toy Planet Trouble…3.3
• CVE-2026-54712OpenTelemetry Java Instrumentation provides OpenTelemetry au…7.5
• CVE-2026-54713CakePHP Queue is a queue-interop compatible queueing library…3.7
• CVE-2026-54714Logto is the modern, open-source auth infrastructure for Saa…6.1
• CVE-2026-54715GoAccess is a real-time web log analyzer and interactive vie…7.1
• CVE-2026-54717Silverstripe CMS is an open source content management system…5.4
• CVE-2026-54718Silverstripe Advanced Workflow is a highly configurable step…7.2
• CVE-2026-54719goshs is a feature-rich single-binary file server for red te…7.5
• CVE-2026-5472A flaw has been found in ProjectsAndPrograms School Manageme…6.3
• CVE-2026-54720Silverstripe Framework is a PHP framework which powers the S…5.4
• CVE-2026-54721Silverstripe UserForms provides a visual form builder for th…8.8