Executive brief
CrowdSec is a security tool that protects systems by blocking malicious IP addresses. A vulnerability in its Local API (LAPI) component allows an unauthenticated attacker to crash the service by sending specially crafted, compressed data. If the service crashes, the system cannot receive new security updates or report new threats, though existing protections remain in place.
Technical details
The CrowdSec Local API (LAPI) router uses the gin-contrib/gzip middleware with DefaultDecompressHandle globally without enforcing a maximum decompressed size. This allows unauthenticated attackers to reach the /v1/watchers and /v1/watchers/login endpoints with highly compressed gzip payloads (Zip Bomb). Upon decompression, these payloads cause excessive heap allocation, leading to a Denial of Service (DoS) as the OS terminates the process due to memory exhaustion. While LAPI typically listens on the loopback interface by default, it is vulnerable to network-based attacks in multi-server deployments where the API is exposed. The issue is fixed in version 1.7.8 by enforcing maximum body size limits.
Affected products
- CrowdSec CrowdSec >= 1.7.0, < 1.7.8
Timeline
- 2026-05-07: patched: Fixes committed to repository
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD