CVE-2026-107839: CWE-400: Uncontrolled Resource Consumption in luskaner ageLANServer

ageLANServer is a cross-platform web server and launcher for offline multiplayer in Age of Empires and Age of Mythology games. In versions before 1.15.2, the AoE3 POST /game/cloud/getFileURL handler does not impose limits on the size of the request body or the length of the JSON 'names' array it processes. This unbounded allocation can be exploited by a remote unauthenticated client using the default self-registration flow to send an oversized request, causing uncontrolled resource consumption. The excessive memory allocation can crash or hang the server process, disconnect active players, and render the service unavailable until a manual restart is performed. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS 3.1 score of 7.5 (high severity). The issue is resolved in version 1.15.2.

A remote unauthenticated attacker can cause a denial of service by sending an oversized request to the affected endpoint, resulting in excessive memory allocation that crashes or hangs the server. This disrupts active player connections and makes the service unavailable until it is manually restarted. There is no impact on confidentiality or integrity reported.

Upgrade ageLANServer to version 1.15.2 or later, where this vulnerability is fixed. Prior to upgrading, consider restricting access to the affected endpoint or implementing network-level protections to limit request sizes if possible. Patch status is confirmed fixed in version 1.15.2.