CVE-2026-55149: Vouch Proxy DOS Vulnerability

CVE-2026-55149 Overview

Vouch Proxy is a single sign-on (SSO) and OAuth/OpenID Connect (OIDC) login solution for Nginx that leverages the auth_request module. Versions prior to 0.48.0 contain an unbounded memory allocation flaw [CWE-789] in pkg/cookie/cookie.go. The cookie reassembly routine parses an attacker-controlled part count from a multipart cookie name and passes it directly to make([]string, numParts) without validating that the value is positive or reasonably bounded. A single unauthenticated request to /validate or /_external-auth-:id can trigger a fatal Go runtime out-of-memory condition and crash the authentication proxy.

Critical Impact
A single unauthenticated HTTP request containing a crafted cookie name such as VouchCookie_1of10000000000 forces an approximately 160 GB slice allocation, crashing the proxy and blocking authentication for all downstream services.

Affected Products

Vouch Proxy versions prior to 0.48.0
Nginx deployments using Vouch Proxy for SSO/OIDC via auth_request
Downstream applications relying on Vouch Proxy for authentication

Discovery Timeline

2026-09-15 - CVE-2026-55149 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-55149

Vulnerability Analysis

The flaw resides in the multipart cookie reassembly logic in pkg/cookie/cookie.go. Vouch Proxy splits large cookies into numbered parts using a naming scheme like VouchCookie_NofM, then reassembles them on subsequent requests. During reassembly, the code extracts the total-part value M from the cookie name and passes it to make([]string, numParts) without any upper bound or sanity check.

Requests to /validate and /_external-auth-:id route through JWTCacheHandler in pkg/jwtmanager/jwtcache.go and FindJWT in pkg/jwtmanager/jwtmanager.go. Cookie reassembly executes before JWT validation, so no valid session, account, or token is required to reach the vulnerable path.

Root Cause

The root cause is missing input validation on an attacker-controlled numeric parameter parsed from an HTTP cookie name. Go's make builtin allocates the full backing array eagerly. Requesting a slice of roughly 10 billion string headers demands approximately 160 GB of contiguous memory, exceeding available resources and triggering a fatal runtime panic that terminates the process.

Attack Vector

Exploitation requires only network reachability to a Vouch Proxy endpoint. An attacker sends an HTTP request with a Cookie header naming a multipart cookie with an oversized total-part value. The proxy parses the name, attempts the allocation, and crashes. Repeating the request each time the proxy restarts sustains a denial-of-service condition against every application protected by that proxy instance.

// Security patch in pkg/cookie/cookie.go
 )
 
 const maxCookieSize = 4000
+const maxCookieParts = 32
 
 var log *zap.SugaredLogger
 var sameSite http.SameSite

Source: GitHub Commit fa18ce3. The fix introduces a maxCookieParts constant of 32 and enforces it before allocation, bounding the slice size regardless of attacker input.

Detection Methods for CVE-2026-55149

Indicators of Compromise

Cookie headers containing names matching the pattern VouchCookie_\d+of\d{5,} where the total-part count is unreasonably large.
Sudden Vouch Proxy process termination with Go runtime fatal error: runtime: out of memory messages in stderr or systemd journal.
Repeated 5xx responses or upstream connection failures from Nginx auth_request handlers immediately after inbound requests to /validate or /_external-auth-:id.

Detection Strategies

Inspect Nginx access logs for requests to /validate and /_external-auth-:id correlated with proxy restarts.
Alert on Go runtime OOM panics or abnormal process exits for the vouch-proxy binary.
Deploy a Web Application Firewall (WAF) rule to flag cookies whose names match the multipart pattern with part counts exceeding a safe threshold such as 32.

Monitoring Recommendations

Track resident set size (RSS) and process uptime for Vouch Proxy; sharp memory spikes preceding termination indicate exploitation attempts.
Monitor authentication-failure and upstream-error rates on Nginx front-ends that depend on Vouch Proxy.
Enable structured logging in Vouch Proxy and forward records to a centralized data lake for correlation with request-source IP addresses.

How to Mitigate CVE-2026-55149

Immediate Actions Required

Upgrade Vouch Proxy to version 0.48.0 or later, which enforces the maxCookieParts = 32 bound.
Restrict network exposure of the Vouch Proxy endpoint so only trusted Nginx front-ends can reach /validate and /_external-auth-:id.
Deploy the proxy under a supervisor such as systemd with automatic restart, paired with rate limiting to reduce sustained outage windows.

Patch Information

The vulnerability is fixed in Vouch Proxy v0.48.0. The corrective change is documented in GitHub Commit fa18ce3 and the GHSA-qqff-5854-px68 advisory. The patch adds a hard cap on the number of cookie parts accepted during reassembly.

Workarounds

Add an Nginx or WAF rule that drops requests carrying cookie names matching VouchCookie_\d+of\d+ where the trailing integer exceeds 32.
Apply per-source-IP rate limiting on the authentication endpoints to slow repeat crash attempts.
Constrain the Vouch Proxy process memory using cgroup or systemd MemoryMax settings so an OOM does not affect co-located services.

bash

# Nginx snippet to reject oversized multipart Vouch cookies
map $http_cookie $vouch_bad_cookie {
    default 0;
    "~*VouchCookie_\d+of\d{3,}" 1;
}

server {
    location /validate {
        if ($vouch_bad_cookie) { return 400; }
        proxy_pass http://vouch_upstream;
    }

    location ~ ^/_external-auth- {
        if ($vouch_bad_cookie) { return 400; }
        proxy_pass http://vouch_upstream;
    }
}