Vulnerability in Boringproxy
CVE-2026-70616
boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.003 (27.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Boringproxy — versions 0
Weakness classification (CWE)
References
- github.com/theopaid/Denial-Of-Service-Through-Unbounded-Resource-Consumption-In… (technical-description, exploit)
- www.vulncheck.com/advisories/boringproxy-resource-exhaustion-dos-via-get-loadin… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-70616?
- CVE-2026-70616 is a medium-severity vulnerability in Boringproxy, classified under CWE-833. CVSS score: 6.5/10. Published 2026-08-05.
- How severe is CVE-2026-70616?
- Medium severity. CVSS v3 base score is 6.5 out of 10.