CyberSecBulletin

Crowdsecurity vulnerabilities

We track 2 vulnerabilities in Crowdsecurity products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 16, 2026.

2vulnerabilities
0critical
2high
0exploited
7.7average CVSS score

Latest Crowdsecurity vulnerabilities

  • 7.2 High severity

    crowdsec: Protection Mechanism Failure

    CVE-2026-44982Crowdsecurity

    CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTT

  • 8.2 High severity

    crowdsec: Improper Handling of Highly Compressed Data (Data Amplification)

    CVE-2026-44981Crowdsecurity

    CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decomp