Approved changes feed: RSS · Atom
cpe:2.3:a:crowdsecurity:crowdsec:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Crowdsecurity (2f0dba8f-775e-51c7-bbc3-598cdbd816f4) |
|---|---|
| Product | Crowdsec (eb9f08eb-875d-5b94-a070-91de6d058251) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44982 |
vulnerable | 2026-07-29 00:52:14.972293 |
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
HIGH (7.2)
CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.
Published: 2026-07-16T19:50:26.067Z
Updated: 2026-07-17T15:01:59.005Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44981 |
vulnerable | 2026-07-29 00:52:14.971994 |
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size and allowing excessive heap allocation that can make LAPI unreachable. This issue is fixed in version 1.7.8.
Published: 2026-07-16T19:47:30.747Z
Updated: 2026-07-17T13:50:30.497Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.