CVE-2026-107839 Details
Description
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2.
A denial-of-service vulnerability has been identified in ageLANServer versions prior to 1.15.2, specifically within the AoE3 POST /game/cloud/getFileURL handler. This vulnerability arises from an unbounded allocation of response storage based on the length of an attacker-controlled JSON names array, without any request body size limit. As a result, a remote unauthenticated client can exploit this flaw by sending oversized requests that cause excessive memory allocation, leading to server crashes or hangs. The issue disrupts active player connections and renders the service unavailable until the server is manually restarted.
Users can upgrade to ageLANServer version 1.15.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/luskaner/ageLANServer/security/advisories/GHSA-4jfq-pmq9-257h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/luskaner/ageLANServer/commit/1dd40166a59356865c0a4b1800f32d05dc8bec79 | [email protected] | Source CodeVendor |
| https://github.com/luskaner/ageLANServer/releases/tag/v1.15.2 | [email protected] | Release NotesVendor |
| https://github.com/luskaner/ageLANServer/security/advisories/GHSA-4jfq-pmq9-257h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| luskaner ageLANServer | < 1.15.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |