CVE-2026-44981 Details

A denial-of-service vulnerability has been identified in CrowdSec LAPI versions 1.7.0 prior to 1.7.8. The issue arises in the LAPI router, which uses 'gin-contrib/gzip' to globally decompress incoming gzip-compressed JSON request bodies on the '/v1/watchers' and '/v1/watchers/login' endpoints. This decompression is performed without enforcing a maximum size, allowing attackers to send small compressed payloads that expand into large JSON documents, leading to excessive memory allocation. In default configurations, this vulnerability is not exploitable over the network, as LAPI only listens on the loopback interface. However, in a multi-server setup where LAPI is exposed to the network, the vulnerability can be exploited if untrusted IPs have access.

Users can update to CrowdSec LAPI version 1.7.8, where this vulnerability has been fixed. If LAPI is exposed on the network, restrict access to trusted IP addresses.