Denial-of-service in CrowdSec's Local API (CVE-2026-44981)

CVE-2026-44981 is a denial-of-service vulnerability in CrowdSec's Local API (LAPI) component, caused by the use of `gin-contrib/gzip` with `DefaultDecompressHandle` globally without enforcing a maximum decompressed size. An attacker can submit small gzip-compressed payloads to unauthenticated endpoints that expand to hundreds of megabytes, causing excessive heap allocation and OS-level process termination; this renders LAPI unreachable and prevents bouncers from fetching new decisions and log processors from sending alerts. Affected versions: - >= 1.7.0 We recommend updating to: 1.7.8. CVSS 8.2 · our assessment: this_week Vendor advisory: https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-273h-gvwr-c3qj Details: https://vuln.today/cve/CVE-2026-44981