EUVD-2026-95934
GHSA-4jfq-pmq9-257h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSelf-register via default flow
-
ExploitPOST oversized JSON names array to /game/cloud/getFileURL
-
ExecutionServer allocates unbounded memory, crashes/hangs
-
ImpactActive players disconnected, service down until restart
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target to be running a vulnerable ageLANServer instance (prior to 1.15.2) with the bundled AoE3 game server active and the default self-registration flow enabled, which it is by default - this removes any authentication barrier (PR:N). The only exploitation prerequisite is network reachability to the server's HTTP port and the ability to reach the AoE3 POST /game/cloud/getFileURL endpoint; no user interaction, elevated privileges, or non-default configuration is needed. Limiting factors are purely scope-of-exposure: the server must be network-reachable and AoE3 handling must be in use, and impact is confined to availability (process crash/hang) with no data disclosure or modification. |
| Impact | This is a genuine but bounded availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: exploitation is remote, low-complexity, and requires no authentication because the server exposes a default self-registration flow, with impact limited strictly to availability (C:N/I:N) via resource exhaustion (CWE-400). No EPSS score, KEV listing, SSVC decision, or public exploit code was provided in the input, so exploitation likelihood cannot be quantified from the data at hand - there is no public exploit identified at time of analysis, only a vendor advisory and the fix commit. The practical priority is driven down sharply by the target product: ageLANServer is a niche, community-maintained LAN emulator for offline Age of Empires/Age of Mythology play, not enterprise infrastructure, so even a trivially triggerable crash affects only the small population of players running a vulnerable self-hosted instance. Net: a real, easily-reproducible denial-of-service flaw, but low real-world urgency due to minimal deployment footprint and availability-only impact. Missing data to note explicitly: EPSS and KEV status were not supplied, so exploitation-in-the-wild cannot be confirmed or ruled out from input. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker registers with the server's default self-registration flow, then sends a single crafted POST to /game/cloud/getFileURL on the bundled AoE3 game server containing an oversized JSON 'names' array. Because response storage is allocated directly from the unbounded array length with no request-body cap, the server balloons memory usage and crashes or hangs, disconnecting all active players until an operator restarts it. No public exploit code is identified at time of analysis, but the fix commit and advisory make the trigger condition trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Remote unauthenticated denial of service in ageLANServer prior to 1.15.2 lets any network-reachable client crash or hang the bundled AoE3 game server by sending an oversized request to the POST /game/cloud/getFileURL endpoint. Because the handler enforces neither a request body size cap nor a bound on the attacker-controlled JSON 'names' array, and sizes response allocations directly from that array length, a single large payload drives excessive memory allocation, processes crash or stall, active players are disconnected, and the service stays down until it is restarted. The default self-registration flow is enabled out of the box, so no credentials or non-default configuration are required; impact is confined to availability, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis. The issue is fixed in version 1.15.2.
RemediationAI
Upgrade to ageLANServer 1.15.2, which is the vendor-released patch for this issue and introduces the 1 MB request body limit in the router middleware; the release is available at https://github.com/luskaner/ageLANServer/releases/tag/v1.15.2, the upstream change is commit 1dd40166a59356865c0a4b1800f32d05dc8bec79, and the advisory is https://github.com/luskaner/ageLANServer/security/advisories/GHSA-4jfq-pmq9-257h. If immediate upgrade is impossible, the most effective compensating control is to stop exposing the game server port beyond trusted peers: bind it to loopback or a specific interface, or firewall the HTTP port to known player addresses, accepting that remote friends can no longer join. Alternatively, front the server with a reverse proxy that enforces a request body limit comparable to the upstream 1 MB cap (for example nginx 'client_max_body_size 1m' with a 413 response); the trade-off is that if any legitimate game flow posts larger bodies, those requests will start failing, so the threshold must be validated against normal AoE3 traffic. Run the service under a supervisor or container memory limit so that a crash or OOM is detected and restarted quickly, which reduces but does not eliminate the outage window, and monitor for repeated 413/500 responses or heavy memory growth on the /game/cloud/getFileURL route as an indicator of attempted abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ageLANServer is a cross-platform Go web server and launcher that emulates vendor backend services so that Age of Empires and Age of Mythology titles can be played offline in multiplayer; its bundled game server exposes HTTP handlers that game clients call. In the AoE3 code path, the POST /game/cloud/getFileURL handler decodes a client-supplied JSON body containing a 'names' array and derives the size of its response storage allocation directly from the length of that array, while binding neither the HTTP request body to any maximum size nor the array element count to any sane upper bound. This is a classic CWE-400 (Uncontrolled Resource Consumption) pattern: attacker-controlled input is used as an allocation size multiplier, so a modest TCP payload can be amplified into disproportionate heap consumption and eventual OOM termination or severe garbage-collection thrashing. The Go standard library itself is not at fault; the omission is in application-level input validation. According to the affected CPE cpe:2.3:a:luskaner:agelanserver:*:*:*:*:*:*:*:*, all releases before 1.15.2 carry the vulnerable handler. The upstream fix (commit 1dd40166a59356865c0a4b1800f32d05dc8bec79, released as v1.15.2) introduces a new router.MaxBodySizeMiddleware that wraps the mux and applies http.MaxBytesReader with a 1 MB (1<<20 byte) ceiling, wiring it in via 'mux = router.MaxBodySizeMiddleware(1<<20, mux)' inside runRoot. That global cap both bounds the JSON 'names' array and closes the allocation amplification, at the cost of rejecting any legitimate request body larger than 1 MB across all routes.
Know when Agelanserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated via default self-registration (AV:N/AC:L/PR:N/UI:N); unbounded allocation crashes the process for availability-only impact (C:N/I:N/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2.
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption) driven by unbounded allocation sized from attacker-controlled input length.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ageLANServer, a self-hosted game server commonly deployed alongside Age of Empires III, can be driven into a crash or hang by a single crafted request to its file-download endpoint prior to version 1.15.2. Because the service is availability-only in impact but restarts are required to recover, affected deployments experience complete local-play outages for all connected players, so leadership should care primarily about the reputation and service-continuity risk where these servers are exposed beyond a trusted network. The fix is a version upgrade rather than a code change on our side.
Apply vendor patch (upgrade to 1.15.2 per advisory). Where the upgrade cannot be completed immediately, interim mitigations include restricting network reachability to trusted clients only, fronting the service with a reverse proxy that enforces request body size limits and rate limits on POST /game/cloud/getFileURL, disabling or gating the default self-registration flow where feasible, and running process supervision with automatic restart to shorten outages.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB