Vulnerability advisory

CVE-2026-44981

CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

Published Jul 16, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-273h-gvwr-c3qjGO-2026-5041

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/crowdsecurity/crowdsec ↗
c3036e21abca984952947360e47f1f36c2ef1b22 to before 632274597a88a6b01ed41c0e6affca0f87ff26df	`632274597a88a6b01ed41c0e6affca0f87ff26df`
Not specified	`54a0dfe6c16b7687b0da6634e0b19ef0f5d9bb30`
Not specified	`56d0d6915f7f25941dc5b4f484028646f6601a37`
Also listed as affected (15) `v1.7.8-rc1` `v1.7.7-rc1` `v1.7.7` `v1.7.6` `v1.7.5` `v1.7.5-rc1` `v1.7.4` `v1.7.4-rc2` `v1.7.4-rc1` `v1.7.1` `v1.7.1-rc4` `v1.7.1-rc3` `v1.7.1-rc2` `v1.7.1-rc1` `v1.7.0`

Description

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size and allowing excessive heap allocation that can make LAPI unreachable. This issue is fixed in version 1.7.8.

CVE-2026-44981

Affected versions

Repository

Description

References