CVE-2026-70616 Details

A resource exhaustion vulnerability has been identified in boringproxy versions 0.1.0 prior to 0.10.0. This vulnerability allows any authenticated user to permanently deplete server resources, including file descriptors, goroutines, and memory. The issue arises when requests are sent to the GET /loading endpoint with arbitrary id query parameter values. The vulnerability exists because the request handler does not validate map lookups and reads from a nil channel, causing the operation to block indefinitely. Without timeouts or context cancellation, each malicious request consumes one goroutine, one file descriptor, and approximately 50 kB of memory. This resource consumption continues until the server reaches its file descriptor limit, at which point it can no longer accept tunnel traffic for any users.

The vulnerability can be addressed by checking the validity of the id parameter before processing the request. Implementing a timeout or cancellation mechanism can also prevent requests from blocking indefinitely. Additionally, configuring the HTTP server with appropriate timeout settings can help mitigate the impact of such resource exhaustion vulnerabilities.