CVE-2026-54716

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/valhalla/valhalla/security/advisories/GHSA-qpf6-xp29-pg6r

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

DFIR Lab@DFIR_Lab23h
🚨 HIGH: CVE-2026-54716 (CVSS 7.5) - Valhalla routing engine vulnerable to DoS via malformed exclude_polygons. Single unauthenticated request can crash worker through unbounded memory growth. NO FIX AVAILABLE. #CVE #Vulnerability #PatchNow https://t.co/wnCQ7EdcIU
0000024
142 followersView on X

Explore more

Back to dashboard