CVE-2026-44219: Jo-Jo98 ciguard denial of service via unbounded SCA HTTP response

CVE-2026-44219 · Severity: low · CVSS 3.7 · Published 2026-05-12

ciguard, a security tool for auditing CI/CD pipelines, contains a flaw where it fails to limit the size of data it downloads from external security databases. If those databases were compromised or if an attacker intercepted the connection, they could send a massive amount of data that crashes the ciguard process by exhausting its available memory. This would cause security scans to fail, potentially disrupting automated software deployment workflows.

Technologies: ciguard (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44219 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44219 being exploited in the wild.
How severe is CVE-2026-44219?
Low severity, with a CVSS score of 3.7, published 12 May 2026.
Which products and versions are affected?
ciguard (PyPI) >= 0.6.0, <= 0.8.1, ECOSYSTEM:introduced=0.6.0,fixed=0.8.2.
Is there a fix for CVE-2026-44219?
Yes. ciguard (PyPI): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44219 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44219?
Check whether you run ciguard (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ciguard (PyPI): upgrade to 0.8.2 or later
    pip install "ciguard>=0.8.2"

Technical details

The SCA HTTP clients in ciguard (specifically in osv.py and endoflife.py) utilize urllib.request to fetch data but call resp.read() without a byte limit. This results in an unbounded memory allocation when the response is passed to json.loads(). An attacker controlling the upstream API endpoints (OSV.dev or endoflife.date) or performing a successful TLS Man-in-the-Middle (MITM) attack could serve a multi-gigabyte response to trigger an Out-of-Memory (OOM) condition. The vulnerability is mitigated by the use of hardcoded HTTPS, making exploitation difficult without CA or DNS compromise. A fix was introduced in version 0.8.2 by implementing a 5MB cap on response bodies.

Affected products

  • Jo-Jo98 ciguard >= 0.6.0, <= 0.8.1

Identifiers

  • CVE-2026-44219
  • GHSA-xw8c-rrvx-f7xq
  • PYSEC-2026-2410

Timeline

  • 2026-04-26: disclosed: Found during internal pentest cycle
  • 2026-04-26: patched: Fix released in v0.8.2
  • 2026-05-05: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.