Answer in brief
CVE-2026-55149 records a High severity (CVSS 7.5) vulnerability in Vouch Proxy: Unbounded Multipart Cookie Allocation DoS. The current sources do not mark it as known exploited. The current feed maps vouch/vouch-proxy (generic), github.com/vouch/vouch-proxy (go), github.com/vouch/vouch-proxy (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps vouch/vouch-proxy (generic), github.com/vouch/vouch-proxy (go), github.com/vouch/vouch-proxy (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| vouch/vouch-proxygeneric | <0.48.0 | 0.48.0 |
| github.com/vouch/vouch-proxygo | >=0 <0.48.0 | 0.48.0 |
| github.com/vouch/vouch-proxygo | <=0.47.2 | 0.48.0 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 20, 2026
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
Quoted source text, attributed separately from HOL analysis.