Executive brief
ciguard, a security tool for auditing CI/CD pipelines, contains a flaw where it fails to limit the size of data it downloads from external security databases. If those databases were compromised or if an attacker intercepted the connection, they could send a massive amount of data that crashes the ciguard process by exhausting its available memory. This would cause security scans to fail, potentially disrupting automated software deployment workflows.
Technical details
The SCA HTTP clients in ciguard (specifically in osv.py and endoflife.py) utilize urllib.request to fetch data but call resp.read() without a byte limit. This results in an unbounded memory allocation when the response is passed to json.loads(). An attacker controlling the upstream API endpoints (OSV.dev or endoflife.date) or performing a successful TLS Man-in-the-Middle (MITM) attack could serve a multi-gigabyte response to trigger an Out-of-Memory (OOM) condition. The vulnerability is mitigated by the use of hardcoded HTTPS, making exploitation difficult without CA or DNS compromise. A fix was introduced in version 0.8.2 by implementing a 5MB cap on response bodies.
Affected products
- Jo-Jo98 ciguard >= 0.6.0, <= 0.8.1
Timeline
- 2026-04-26: disclosed: Found during internal pentest cycle
- 2026-04-26: patched: Fix released in v0.8.2
- 2026-05-05: advisory: GitHub Advisory published