Vouch-proxy versions before 0.48.0 contain a memory allocation vulnerability (CWE-789) in the cookie parsing logic. The vulnerable code parses the total part count from an attacker-controlled multipart cookie name and uses this value unchecked to allocate a slice. An attacker can craft a cookie name such as 'VouchCookie_1of10000000000' to trigger an allocation of approximately 160 GB, causing the Go runtime to crash due to out-of-memory conditions. This crash occurs before JWT validation and does not require a valid session or account. The vulnerability affects requests to /validate and /_external-auth-:id endpoints and allows an attacker to cause a denial of service by crashing the authentication proxy. The issue is resolved in vouch-proxy version 0.48.0.

Successful exploitation causes the vouch-proxy authentication service to crash due to out-of-memory conditions, resulting in denial of service. There is no impact on confidentiality or integrity, as the vulnerability does not allow bypassing authentication or accessing sensitive data. The availability of the authentication proxy is affected until it is restarted or patched.

Upgrade vouch-proxy to version 0.48.0 or later, where this vulnerability is fixed. No other mitigation is indicated or necessary as the fix addresses the root cause. Patch status is confirmed by the vendor advisory stating the issue is resolved in 0.48.0.