CVE-2026-44981

HighCVSS 8.2

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

CrowdSec versions 1.7.0 through 1.7.8 have a vulnerability in the LAPI router that globally uses gin-contrib/gzip with DefaultDecompressHandle. This decompresses unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size, allowing excessive heap allocation that can make LAPI unreachable.

Risk Assessment

An attacker can send a crafted gzip request, causing memory exhaustion and denial of service of the LAPI service, disrupting protection against malicious IPs.

Recommendation

Immediately update CrowdSec to version 1.7.8 or later, which includes a fix limiting the decompressed data size.

Other vulnerabilities in CrowdSec

CVE-2026-44982High
A vulnerability in CrowdSec from version 1.5.0 to 1.7.8 causes HTTP/1.1 requests with Transfer-Encoding: chunked and HTTP/2 requests without a Content-Length header to be processed with an empty request body buffer. As a result, WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML are skipped.

Original NVD description (English source)

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size and allowing excessive heap allocation that can make LAPI unreachable. This issue is fixed in version 1.7.8.