Executive brief
Valhalla is an open-source routing engine that processes geographic data from OpenStreetMap to calculate travel routes. An attacker can send a single unauthenticated POST request with a malformed exclusion polygon to the /sources_to_targets endpoint, causing the server to consume memory without bound until the process crashes. This results in immediate service outage for any publicly exposed Valhalla deployment.
Technical details
The vulnerability is an algorithmic denial-of-service in the polygon processing logic (src/loki/polygon_search.cc) triggered by degenerate geometry: a ring formed by three collinear points with zero area. When such a polygon is included in the exclude_polygons parameter of a POST request to /sources_to_targets, the code enters unbounded iteration, allocating memory until the operating system terminates the worker process with an out-of-memory error. The attack requires no authentication or user interaction and is reachable over the network. The attacker can reliably crash any worker by sending a crafted /sources_to_targets request; other endpoints like /route may also be affected but were not verified. As of the advisory date, no patched version is available.
Affected products
- Valhalla Valhalla 3.7.0 and earlier
Timeline
- 2026-06-09: disclosed: Advisory published on GitHub
- 2026-09-17: advisory: CVE-2026-54716 published on NVD