CVE-2026-19362 Overview
CVE-2026-19362 affects lmammino oidc-authorizer version 0.4.0, an OpenID Connect (OIDC) authorization component written in Rust. The vulnerability resides in the parse_token_from_header function within src/parse_token_from_header.rs, part of the Authorization Header Parsing component. Attackers manipulate the authorization_token argument to trigger a denial of service condition. The flaw is remotely exploitable over the network without authentication or user interaction. Public disclosure has occurred, and exploit details are available. According to the reporter, the vendor was contacted before disclosure but did not respond.
Critical Impact
Unauthenticated remote attackers can send crafted Authorization headers to disrupt availability of services relying on oidc-authorizer 0.4.0 for token validation.
Affected Products
- lmammino oidc-authorizer version 0.4.0
- Applications using oidc-authorizer as an OIDC token validator in front of protected APIs
- AWS Lambda authorizers built on top of the affected component
Discovery Timeline
- 2026-08-09 - CVE-2026-19362 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19362
Vulnerability Analysis
The defect is categorized under CWE-404: Improper Resource Shutdown or Release. The parse_token_from_header function processes the value of the HTTP Authorization header before token validation occurs. When the authorization_token argument is manipulated with specific input, the parser fails to release or bound resources correctly, leading to a denial of service.
Because oidc-authorizer is typically deployed at the edge of an API to validate OIDC bearer tokens, disruption of this component blocks legitimate authentication flows for every downstream service. The attack requires only network reachability to any endpoint that forwards the Authorization header into the affected parser.
Root Cause
The root cause is improper handling of untrusted input during header parsing in src/parse_token_from_header.rs. The function does not adequately constrain or safely dispose of resources associated with malformed or malicious token strings, which allows a caller-controlled value to degrade availability.
Attack Vector
Exploitation is network-based and unauthenticated. An attacker issues an HTTP request containing a crafted Authorization header value. The affected parser processes the value and enters a state that consumes or fails to release resources, producing a denial of service against the authorizer and any application depending on it. No privileges or user interaction are required.
Code-level exploitation details for this issue have been referenced publicly via VulDB entry for CVE-2026-19362 and the associated VulDB vulnerability record #387216. No verified proof-of-concept code is reproduced here.
Detection Methods for CVE-2026-19362
Indicators of Compromise
- Unusual spikes in error rates, timeouts, or restarts of processes or Lambda functions hosting oidc-authorizer 0.4.0.
- HTTP requests containing malformed, oversized, or structurally anomalous Authorization: Bearer header values.
- Repeated requests from a single source targeting authenticated endpoints without producing valid token validations.
Detection Strategies
- Inspect HTTP access logs for Authorization header values that deviate from expected JSON Web Token (JWT) structure, including missing dots, non-Base64URL characters, or excessive length.
- Correlate authorizer error metrics with upstream request patterns to identify targeted denial of service attempts.
- Deploy a Web Application Firewall (WAF) rule that validates the shape of bearer tokens before requests reach the authorizer.
Monitoring Recommendations
- Track latency, memory, and CPU consumption of processes running oidc-authorizer and alert on sustained deviations from baseline.
- Monitor 5xx responses and cold-start rates on API gateways fronted by the authorizer.
- Aggregate authorization failure events by source IP and User-Agent to detect abuse campaigns.
How to Mitigate CVE-2026-19362
Immediate Actions Required
- Inventory all services using lmammino oidc-authorizer 0.4.0 and identify network exposure of endpoints protected by it.
- Place a WAF or API gateway rule in front of the authorizer to reject requests with malformed Authorization headers before parsing.
- Apply rate limiting per source IP on endpoints that invoke the authorizer to reduce impact from abusive traffic.
Patch Information
At the time of publication, no vendor-supplied patch has been referenced in the NVD entry, and the vendor did not respond to the reporter. Consult the VulDB CVE-2026-19362 report and the project repository for updates. Track new releases of oidc-authorizer beyond 0.4.0 and upgrade once a fixed version is published.
Workarounds
- Enforce strict input validation at the API gateway: require the Authorization header to match a Bearer JWT pattern (Bearer <base64url>.<base64url>.<base64url>) with reasonable length bounds before invocation.
- Deploy the authorizer with concurrency, memory, and timeout limits so that resource exhaustion in one instance does not degrade the entire service.
- Where feasible, substitute an alternative maintained OIDC validator or a managed identity provider integration until a fixed release is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
