Description
A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of the component Authorization Header Parsing. The manipulation of the argument authorization_token leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the parse_token_from_header function of lmammino oidc-authorizer 0.4.0, where an attacker can supply a crafted Authorization header that causes the service to crash, resulting in denial of service. The flaw is a resource‑exhaustion weakness described by CWE-404.

Affected Systems

Affected systems are installations of lmammino oidc-authorizer version 0.4.0. No other versions or vendors are known to be impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. Remote exploitation is possible and the exploit has been publicly disclosed, but the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The lack of vendor response elevates the risk until a patch is applied, and attackers could trigger service outages from outside the network.

Generated by OpenCVE AI on August 9, 2026 at 18:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch for lmammino oidc-authorizer version 0.4.0 or higher that addresses the parse_token_from_header flaw; if no patch, replace or remove the component.
  • Configure the reverse proxy or API gateway to reject requests with malformed or excessively large Authorization headers before they reach the application.
  • Implement application‑level rate limiting or circuit breaker logic around header parsing to mitigate repeated crash attempts.
  • Monitor logs for parse_token_from_header failures or service restarts and alert on potential exploitation attempts.

Generated by OpenCVE AI on August 9, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 09 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of the component Authorization Header Parsing. The manipulation of the argument authorization_token leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service
First Time appeared Lmammino
Lmammino oidc-authorizer
Weaknesses CWE-404
CPEs cpe:2.3:a:lmammino:oidc-authorizer:*:*:*:*:*:*:*:*
Vendors & Products Lmammino
Lmammino oidc-authorizer
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Lmammino Oidc-authorizer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-10T16:07:25.646Z

Reserved: 2026-08-08T20:18:33.233Z

Link: CVE-2026-19362

cve-icon Vulnrichment

Updated: 2026-08-10T16:07:17.094Z

cve-icon NVD

Status : Deferred

Published: 2026-08-09T18:16:43.117

Modified: 2026-08-12T20:59:21.023

Link: CVE-2026-19362

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T14:26:55Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release