Skip to content
OpenAdvisories

Package · Go

github.com/crowdsecurity/crowdsec

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.2
    CVE-2026-44982

    CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

    CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HT…

    crowdsecurity crowdsec github.com/crowdsecurity/crowdsec crowdsec Ubuntu Go
  • High 8.2
    CVE-2026-44981

    CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

    CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decom…

    crowdsecurity crowdsec github.com/crowdsecurity/crowdsec crowdsec Ubuntu Go