CyberRota Analysis
AI-GeneratedCrowdSec versions 1.7.0 to 1.7.8 are vulnerable due to improper handling of gzip-compressed JSON request bodies, which allows unauthenticated requests to cause excessive heap allocation, potentially leading to denial of service for the LAPI. Organizations using affected versions should prioritize upgrading to version 1.7.8 to mitigate the risk of service disruption. This vulnerability is particularly relevant for those relying on CrowdSec for IP protection and security monitoring.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size and allowing excessive heap allocation that can make LAPI unreachable. This issue is fixed in version 1.7.8.