CVE-2026-107839 in ageLANServer
Summary
by MITRE • 10/09/2026
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The ageLANServer utility serves as a critical infrastructure component for maintaining offline multiplayer connectivity across various titles within the Age of Empires and Age of Mythology franchises. Acting as both a web server and launcher, it facilitates game discovery and session management by handling client requests related to game state synchronization and resource retrieval. The specific vulnerability resides in the POST /game/cloud/getFileURL endpoint, which is responsible for processing requests that retrieve file URLs necessary for gameplay continuity. This handler operates within an unauthenticated context due to the default self-registration flow, allowing any remote actor with network access to interact directly with the service without prior authentication credentials.
The core technical flaw involves a lack of input validation and resource management controls regarding request body size and array length constraints. Specifically, when processing JSON payloads containing names arrays for file retrieval operations, the server fails to impose limits on either the total byte count of the POST body or the number of elements within the attacker-controlled JSON names array. Instead of validating these inputs against predefined thresholds, the application proceeds to allocate response storage memory directly proportional to the length of the provided array. This design decision creates a direct correlation between untrusted user input and system resource consumption, effectively allowing an external actor to dictate how much memory the server process must reserve for handling a single request.
This architectural deficiency leads to severe operational impacts characterized by excessive memory allocation that can quickly exhaust available system resources on the host machine. When a remote unauthenticated client submits an oversized request with a significantly inflated names array, the server attempts to allocate vast amounts of contiguous or fragmented memory based on the malicious input size. This action triggers either immediate process crashes due to out-of-memory conditions or prolonged hangs as the system struggles to satisfy the allocation requests. The instability directly affects active gameplay sessions, causing connected players to be disconnected abruptly and disrupting ongoing matches. Furthermore, because the server process becomes unresponsive or terminates unexpectedly, the service remains unavailable until an administrator manually restarts it, resulting in a denial of service for all users attempting to access offline multiplayer features during that downtime window.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-787, indicating Out-of-bounds Write if the memory corruption leads to buffer overflows in underlying implementations. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with techniques related to Denial of Service (T1499) and potentially Resource Hijacking depending on whether the resource exhaustion impacts other processes or systems sharing the same host environment. The attack vector leverages standard HTTP POST methods, making it easily executable via common network tools without requiring specialized exploit kits beyond basic scripting capabilities.
Mitigation strategies primarily involve upgrading to version 1.15.2 of ageLANServer, where the developers have implemented proper input validation and resource limits for the affected endpoint. Until an upgrade is feasible, administrators should consider deploying a reverse proxy or web application firewall in front of the server to inspect incoming POST requests. These intermediary security controls can enforce strict size limits on request bodies and array lengths before they reach the vulnerable application logic. Additionally, restricting network access to this service by configuring firewalls to allow connections only from trusted local subnets reduces the attack surface for unauthenticated remote actors who might otherwise exploit this flaw over public or less secure networks.