Which versions of boringproxy are affected by CVE-2026-70616?

boringproxy versions through 0.10.0 contain a denial-of-service vulnerability allowing any authenticated user to permanently exhaust server resources (file descriptors, memory, goroutines), halting…

How to fix or mitigate CVE-2026-70616?

Within 24 hours: restrict network access to boringproxy to trusted users only and implement HTTP request rate limiting per user (recommend max 10 requests/min to /loading endpoint); monitor file descriptor usage with alerts if approaching OS limits. Within 7 days: implement request timeout policies (60-second maximum), disable or restrict the GET /loading endpoint if not business-critical, and deploy runtime monitoring for goroutine and memory growth per connection. Within 30 days: monitor boringproxy GitHub releases for a patch and upgrade immediately upon availability, or migrate to an alternative tunnel solution with built-in resource exhaustion protections if no patch timeline is announced.

boringproxy CVE-2026-70616

Q: What is the CVSS score of CVE-2026-70616?

CVE-2026-70616 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53598 HIGH

Deadlock (CWE-833)

2026-08-05 disclosure@vulncheck.com

GHSA-5gjj-xq44-85r4

Denial Of Service

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint requires low-privilege authentication (PR:L); nil channel deadlock causes full availability loss; no confidentiality or integrity impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:35 vuln.today

CVE Published

Aug 05, 2026 - 20:17 cve.org

HIGH 7.1

DescriptionCVE.org

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server's file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.

AnalysisAI

Resource exhaustion in boringproxy through 0.10.0 allows any authenticated user to permanently consume server file descriptors, goroutines, and memory by repeatedly requesting the GET /loading endpoint with arbitrary id parameter values. The handler blindly attempts to receive from a nil channel - a Go-language primitive that blocks forever - with no map-lookup validity check, no HTTP server timeouts, no context cancellation, and no runtime reclamation, meaning each malicious request permanently holds one goroutine (~50 kB stack), one file descriptor, and associated heap memory. Once the server's file descriptor limit is exhausted, all listener Accept calls fail and tunnel traffic forwarding halts for every connected user. A public proof-of-concept writeup exists on GitHub; no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

boringproxy is a Go-based reverse tunnel proxy. The vulnerable component is the GET /loading HTTP handler, which accepts a user-supplied id query parameter intended to correlate with a pending in-flight request. The handler performs no validation of whether the id maps to an existing entry before executing a channel receive operation. In Go, receiving from a nil channel (<-nilChan) suspends the goroutine indefinitely with no possibility of resumption - it is not garbage-collected and cannot be unblocked by the Go runtime. This is classified under CWE-833 (Deadlock) because the goroutine enters a permanent waiting state. Compounding the flaw, the server is configured without Go http.Server read/write timeouts, meaning the underlying TCP connection (and its file descriptor) is never closed by the server side. The Go runtime does not reclaim goroutines blocked on nil channels through GC, making every malicious request a permanent resource leak until the process is restarted. Affected software is boringproxy version 0.10.0 and all prior releases.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point only to a PoC writeup and a VulnCheck advisory, with no fixed version cited. Until a patch is released, operators should restrict authenticated access to the /loading endpoint at the network layer (firewall or upstream reverse proxy ACL) to the minimum necessary set of trusted users, reducing the pool of potential abusers. As a source-level workaround, operators capable of self-compiling can configure http.Server.ReadTimeout and WriteTimeout on the boringproxy HTTP server to enforce connection-level deadlines, which would unblock goroutines and trigger file descriptor reclamation - this requires modifying the Go source before building. Operators should also monitor server file descriptor consumption (e.g., via /proc/<pid>/fd count or ulimit -n headroom alerts) and set alerting thresholds to detect accumulation before service impact occurs. Restricting the number of concurrent authenticated sessions per user at the authentication layer can reduce amplification. Monitor the VulnCheck advisory and boringproxy upstream repository for a patched release.