Executive brief
vouch-proxy is an authentication gateway used to protect applications by validating user sessions. A flaw in its cookie parsing logic allows an unauthenticated attacker to send a single HTTP request with a maliciously crafted cookie name that triggers an unbounded heap allocation. This causes the server process to crash immediately due to out-of-memory errors, taking down the authentication service and making protected applications inaccessible until the service restarts.
Technical details
The vulnerability exists in pkg/cookie/cookie.go in the Cookie() function, which processes multipart cookies identified by a _NofM suffix. When parsing the cookie name, the code calls strconv.Atoi(xyArray[1]) on attacker-controlled input without any bounds checking or validation. This parsed value is then passed directly to make([]string, numParts), requesting that amount of memory. An attacker can craft a cookie name like VouchCookie_1of10000000000 to request ~160 GB of heap allocation in a single call. The vulnerable code path is reachable at /validate and /_external-auth-:id endpoints without authentication, as the cookie parsing occurs in JWTCacheHandler before JWT validation. The exploit is 100% deterministic: a single unauthenticated HTTP request crashes the Go runtime with a fatal out-of-memory error (exit code 2). A patch is available in version 0.48.0 that adds a maximum cookie parts constant (maxCookieParts = 32) and validates the parsed count before allocation.
Affected products
- vouch vouch-proxy <= 0.47.2
Timeline
- 2026-06-11: disclosed: Vulnerability disclosed on GitHub Advisory Database
- 2026-08-20: advisory: Advisory updated with additional details
- 2026-06-11: patched: Fixed in version 0.48.0 with bounds checking and validation