crowdsecurity github.com/crowdsecurity/crowdsec vulnerabilities

Latest crowdsecurity github.com/crowdsecurity/crowdsec CVEs

Newest publication first

1. CVE-2026-44982 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

   Published 2026-07-16

   High·CVSS 7.2 EPSS 0.37%

   CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without...

2. CVE-2026-44981 CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

   Published 2026-07-16

   High·CVSS 8.2 EPSS 0.51%

   CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.