CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to exploit the GET /loading endpoint in boringproxy versions up to 0.10.0, leading to resource exhaustion by permanently consuming server file descriptors, goroutines, and memory. This can result in a denial of service, as the server becomes unable to accept new connections once the file descriptor limit is reached. Organizations using affected versions should prioritize this issue to prevent service disruptions and ensure continued availability of their proxy services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.