crowdsec vulnerabilities

2 known vulnerabilities in crowdsec from Crowdsecurity. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  crowdsec: Protection Mechanism Failure

  CVE-2026-44982Jul 16, 2026Crowdsecurity

  CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTT

• 8.2 High severity

  crowdsec: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-44981Jul 16, 2026Crowdsecurity

  CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decomp