CVE-2026-44981 is a high-severity vulnerability in CrowdSec's LAPI router affecting versions from 1.7.0 up to but not including 1.7.8. The vulnerability arises because the gin-contrib/gzip middleware with DefaultDecompressHandle is used globally for decompressing gzip-compressed JSON request bodies on the /v1/watchers and /v1/watchers/login endpoints without enforcing a maximum decompressed size. This allows an attacker to send specially crafted compressed data that decompresses to a very large size, causing excessive heap memory allocation and potentially making the LAPI service unreachable due to resource exhaustion. The vulnerability is classified under CWE-409 (Improper Handling of Highly Compressed Data).

An attacker can cause a denial of service by sending unauthenticated gzip-compressed JSON requests that decompress to a large size, leading to excessive heap memory usage and making the LAPI service unavailable. There is no indication of data disclosure or privilege escalation. The impact is limited to service availability degradation.

Upgrade CrowdSec to version 1.7.8 or later, where this issue is fixed by enforcing limits on decompressed data size. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes or repository. Until upgraded, consider restricting access to the affected endpoints or implementing external rate limiting to mitigate potential abuse.