| शीर्षक | Rowboat Labs Rowboat 0.1.0 Denial of Service |
|---|
| विवरण | Rowboat has multiple HTTP entry points that fully read, parse, validate, or log attacker-controlled request bodies before authentication or signature verification.
The Composio webhook endpoint calls request.text() and logs the complete payload before verifying the webhook signature. The API chat endpoint calls req.json() and validates the complete messages and mockTools body before API key authorization. The related schemas do not enforce maximum request size, message count, string length, object depth, tool-call count, or mockTools entry limits.
An unauthenticated attacker can send oversized request bodies and force the Rowboat web process to allocate memory and perform parsing or logging work before the request is rejected. This can exhaust process memory, grow logs, and make normal Rowboat service access fail. |
|---|
| स्रोत | ⚠️ https://github.com/hackerguopeng/cve/tree/main/Rowboat_PreAuth_Body_Buffer_DoS_Report |
|---|
| उपयोगकर्ता | hackerguopeng (UID 99623) |
|---|
| सबमिशन | 11/07/2026 09:29 AM (2 महीनों पहले) |
|---|
| संयम | 02/09/2026 03:21 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398131 [rowboatlabs rowboat तक 0.9.1 Composio Webhook Endpoint route.ts request.text/req.json सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|