CVE-2026-55149 in Vouch
Summary
by MITRE • 09/15/2026
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The Vouch Proxy serves as a single sign-on and OAuth or OpenID Connect login solution for Nginx environments, leveraging the auth_request module to handle authentication flows securely. In versions prior to 0.48.0, a critical vulnerability exists within the cookie parsing logic located in pkg/cookie/cookie.go. This flaw stems from an improper validation of input data specifically related to multipart cookies. When processing requests that involve complex or malformed cookie structures, the application extracts the total part count directly from an attacker-controlled multipart cookie name without performing adequate bounds checking. The code proceeds to pass this unvalidated value directly into a slice allocation function, make([]string, numParts), which attempts to allocate memory based on the provided integer size.
This technical flaw leads to a severe resource exhaustion scenario classified under CWE-789: Memory Allocation with Excessive Size Value. Because there is no check to ensure that the part count is positive or reasonably bounded within system limits, an attacker can supply a cookie name such as VouchCookie_1of10000000000. This input causes the Go runtime to attempt allocating approximately 160 gigabytes of memory for a single string slice. Since this amount far exceeds available physical and virtual memory on typical server infrastructure, the operation triggers a fatal out-of-memory condition within the Go runtime environment. The vulnerability is particularly dangerous because it does not require any form of authentication or valid session token to exploit.
The operational impact of this flaw results in a complete denial of service for the Vouch Proxy instance. Requests directed at endpoints such as /validate and /_external-auth-:id trigger the vulnerable code path by passing through JWTCacheHandler, FindJWT, and finally reaching the cookie reassembly logic before JWT validation occurs. A single crafted request is sufficient to crash the authentication proxy due to the memory allocation failure. If an attacker sends repeated requests with similarly malicious multipart cookies, they can sustain this unavailability state indefinitely, effectively taking down the entire authentication service for all users relying on it. This aligns with ATT&CK technique T1498: Network Denial of Service, as the attack vector directly targets resource availability rather than confidentiality or integrity.
Mitigation strategies primarily involve upgrading to version 0.48.0 or later, where this vulnerability has been patched by implementing proper input validation and bounds checking for cookie part counts. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls can be configured to inspect HTTP headers and reject requests containing excessively large multipart cookies or anomalous header sizes. Additionally, configuring Nginx with strict limits on client header buffer sizes can help prevent the transmission of maliciously crafted cookie names that trigger this memory exhaustion flaw.