{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vouch-proxy-0.47.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vouch Proxy (0.47.2)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","webserver"],"_cs_type":"advisory","_cs_vendors":["Vouch"],"content_html":"\u003cp\u003eVouch Proxy version 0.47.2 is susceptible to an unauthenticated remote denial-of-service vulnerability due to unsafe parsing of multipart cookies. The vulnerability resides in the \u003ccode\u003epkg/cookie/cookie.go\u003c/code\u003e file within the \u003ccode\u003eCookie()\u003c/code\u003e function, which reassembles multipart cookies based on names containing the \u003ccode\u003e_NofM\u003c/code\u003e suffix. An attacker can craft a specific HTTP request containing a cookie name with an arbitrarily large integer for the total part count (e.g., \u003ccode\u003eVouchCookie_1of10000000000\u003c/code\u003e). This value is parsed via \u003ccode\u003estrconv.Atoi\u003c/code\u003e and passed directly to \u003ccode\u003emake([]string, numParts)\u003c/code\u003e without bounds checking. Because this logic executes before authentication during the request handling flow, an attacker can trigger an immediate out-of-memory fatal error in the Go runtime, crashing the process. This attack is highly reliable and does not require a valid session.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target server running Vouch Proxy.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP GET request targeting the \u003ccode\u003e/validate\u003c/code\u003e or \u003ccode\u003e/_external-auth-:id\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious \u003ccode\u003eCookie\u003c/code\u003e header into the request, specifically using the format \u003ccode\u003eVouchCookie_1of\u0026lt;Large_Integer\u0026gt;=x\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eVouch Proxy receives the request and, before any authentication, invokes the \u003ccode\u003eJWTCacheHandler\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eJWTCacheHandler\u003c/code\u003e calls \u003ccode\u003eFindJWT\u003c/code\u003e, which subsequently calls the vulnerable \u003ccode\u003ecookie.Cookie\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecookie.Cookie\u003c/code\u003e function splits the cookie name suffix and parses the attacker-controlled total part count via \u003ccode\u003estrconv.Atoi\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application executes \u003ccode\u003emake([]string, numParts)\u003c/code\u003e with the unvalidated large integer.\u003c/li\u003e\n\u003cli\u003eThe Go runtime attempts to allocate massive amounts of memory, resulting in a fatal out-of-memory crash and immediate denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate crash of the Vouch Proxy process. In containerized environments, the service will repeatedly restart, potentially creating a persistent state of denial-of-service if the attacker continues to send the payload. As Vouch Proxy is typically deployed as an authentication gateway, its unavailability can render protected downstream applications unreachable or cause them to fail-open, potentially leading to unauthorized access depending on the reverse-proxy configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection engineering and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Vouch Proxy to the latest version to include input validation for multipart cookie names and strict bounds checking on part counts.\u003c/li\u003e\n\u003cli\u003eApply WAF rules to block or sanitize HTTP requests containing cookie names that exceed reasonable length or format expectations for \u003ccode\u003e_NofM\u003c/code\u003e multipart suffixes.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for service crashes and frequent container restarts in the Vouch Proxy environment to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect abnormal cookie header values that indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:15:55Z","date_published":"2026-08-20T19:15:55Z","id":"https://feed.craftedsignal.io/briefs/2026-08-vouch-proxy-dos/","summary":"Vouch Proxy contains an unauthenticated heap-allocation vulnerability in its multipart cookie reassembly logic that allows remote attackers to crash the service via a crafted HTTP cookie.","title":"Unauthenticated Denial of Service in Vouch Proxy","url":"https://feed.craftedsignal.io/briefs/2026-08-vouch-proxy-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Vouch Proxy (0.47.2)","version":"https://jsonfeed.org/version/1.1"}