BoringProxy through 0.10.0 contains a resource exhaustion vulnerability that permits any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by repeatedly accessing the GET /loading endpoint with attacker‑supplied id query parameters. The request handler performs no map‑lookup validity check and receives on a nil channel, leading to a goroutine that blocks forever. The lack of timeouts, context cancellation, or HTTP server timeouts means each malicious request occupies a goroutine, a file descriptor, and about 50 kB of memory until the server’s file‑descriptor limit is reached. Once that limit is exceeded, the listener’s Accept calls fail, and all tunnel traffic forwardings for all users are halted.

BoringProxy version 0.10.0 (and any earlier release before a fix) is affected. The vulnerability is tied to the GET /loading endpoint in the BoringProxy binary.

The CVSS score of 7.1 indicates a high‑risk denial‑of‑service condition. The EPSS score is not available, but the lack of activation conditions (any authenticated user can trigger it) and the absence of mitigation in the handler suggest a high likelihood of exploitation in environments where such users have network access. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can, by sending many requests, deplete all the server’s available file descriptors and halt progression, effectively locking other users out and potentially causing a service outage.