Executive brief
AirSane is a scanner server that allows networked computers to share scanner hardware over the Apple AirScan protocol. A flaw in its built-in HTTP server allows an unauthenticated attacker to crash the scanning service by sending a specially crafted request with an extremely large Content-Length header, forcing the server to exhaust all available memory and shut down. This makes the scanner unavailable to legitimate users.
Technical details
The vulnerability is a missing input validation flaw in httpserver.cpp where the Content-Length HTTP header is read and directly passed to std::string::resize() without bounds checking. An attacker can send an HTTP POST request with an artificially large Content-Length value (e.g., gigabytes), causing the daemon to attempt excessive memory allocation, trigger a std::bad_alloc exception, and crash. Additionally, non-numeric characters in the Content-Length header trigger undefined behavior due to unsafe NaN-to-integer conversion during parsing. The attack requires no authentication and is network-accessible. Version 0.4.12 patches the issue by validating header input and implementing safe parsing.
Affected products
- AirSane Project AirSane prior to 0.4.12
Timeline
- 2026-09-11: disclosed