This vulnerability allows an attacker to send a gzip‑compressed JSON request that decompresses without a size limit to the CrowdSec LAPI endpoints /v1/watchers and /v1/watchers/login. Because the gin‑contrib/gzip DefaultDecompressHandle is applied globally, an unauthenticated request can trigger the server to allocate an unbounded amount of heap memory during decompression, leading to resource exhaustion that makes the API unreachable and results in a denial of service. The flaw is classified as CWE‑409 and can affect the availability of all services monitored by CrowdSec.

CrowdSec LAPI in CrowdSec 1.7.0 through 1.7.7 is affected. Version 1.7.8 and later include the fix, removing the unbounded decompression. The issue is present in all deployments of these versions regardless of the external configuration of the LAPI router.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is HTTP, with no authentication required, making it straightforward for an attacker to trigger the resource exhaustion by sending a carefully crafted gzip payload to the affected endpoints.