ciguard is a CI/CD pipeline security auditor that, between versions 0.6.0 and 0.8.1, uses two HTTP client modules to fetch vulnerability data from third‑party services. These modules read the entire HTTP response body with json.loads(resp.read().decode('utf-8')) without imposing any maximum size limit. If an attacker can influence the data source—by compromising endoflife.date/OSV.dev or performing a TLS man‑in‑the‑middle attack—a response containing several gigabytes can be returned, causing the ciguard process to consume enormous amounts of memory until it is terminated. The primary impact is a local denial of service that disrupts pipeline runs, rather than privilege escalation or data disclosure.

The affected product is Jo‑Jo98 ciguard, specifically versions 0.6.0 through 0.8.1. No other vendors or products are listed as affected.

The CVSS base score is 3.7 and an EPSS score is not available, indicating a moderate severity and uncertain exploitation likelihood. The vulnerability is not included in the CISA KEV catalog. Attackers would need access to the vended HTTP endpoints used by ciguard, suggesting a network‑based vector where the victim’s environment connects to an external service. Successful exploitation would require the attacker to supply a very large payload; thus, the opportunity is limited to contexts that allow such data to be sent to the client.