CVE-2026-55149

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.

• CWE-789

• https://github.com/vouch/vouch-proxy/commit/fa18ce30ba50a4863a436acad044c22965329c4f
• https://github.com/vouch/vouch-proxy/releases/tag/v0.48.0
• https://github.com/vouch/vouch-proxy/security/advisories/GHSA-qqff-5854-px68
• https://github.com/vouch/vouch-proxy/security/advisories/GHSA-qqff-5854-px68

Published

Sep 15, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55139Out-of-bounds read in Microsoft Office allows an unauthorize…3.3
• CVE-2026-55140Heap-based buffer overflow in Microsoft Office allows an una…7.8
• CVE-2026-55141Stack-based buffer overflow in Microsoft Office Excel allows…7.8
• CVE-2026-55142Numeric truncation error in Microsoft Office Word allows an …5.5
• CVE-2026-55144Missing cryptographic step in Windows CryptoAPI allows an au…7.1
• CVE-2026-55145Improper neutralization of special elements used in a comman…7.1
• CVE-2026-5515IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores …5.5
• CVE-2026-55153mchange-commons-java is a Java library of shared utility cla…7.1
• CVE-2026-55158Conflibot warns in advance when merging a pull request will …9.1
• CVE-2026-55159luci-app-adblock-fast a WebUI for fast, lightweight DNS-base…8.8
• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55162Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…6.3