EUVD-2026-54933
GHSA-gv74-4w48-83fh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication, no scope change; impact strictly limited to availability (DoS only), consistent with CWE-404 and CVSS 4.0 VA:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of the component Authorization Header Parsing. The manipulation of the argument authorization_token leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Denial of service in lmammino oidc-authorizer 0.4.0 can be triggered remotely by submitting a crafted value for the authorization_token argument processed by the parse_token_from_header function in the Authorization Header Parsing component. Any service using this Rust library to validate OIDC tokens via the HTTP Authorization header is exposed to availability disruption without requiring authentication. A public proof-of-concept exploit has been disclosed, though the vulnerability is not confirmed as actively exploited in CISA KEV.
Technical ContextAI
oidc-authorizer is a Rust library implementing OpenID Connect (OIDC) token authorization, designed to protect API endpoints by parsing and validating Bearer tokens extracted from HTTP Authorization headers. The affected code path is the parse_token_from_header function in src/parse_token_from_header.rs. The root cause class is CWE-404 (Improper Resource Shutdown or Release), meaning the function fails to properly clean up or release resources when processing a malformed or adversarially crafted authorization_token value, resulting in an uncontrolled availability impact. The CPE string cpe:2.3:a:lmammino:oidc-authorizer:*:*:*:*:*:*:*:* uses a version wildcard, suggesting NVD may consider a broader version range potentially affected beyond the 0.4.0 specifically named in the description.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, leaving no confirmed fixed version. Operators should monitor the lmammino/oidc-authorizer repository on crates.io and its upstream source for a remediated release. As an immediate compensating control, restrict network access to services using this library by placing them behind an authenticated upstream proxy or API gateway that strips and re-validates Authorization headers before forwarding, preventing attacker-controlled header content from reaching the vulnerable parsing function. Alternatively, deploying a WAF rule to reject malformed, oversized, or structurally invalid Authorization header values reduces the attack surface with minimal application-side changes. At the code level, wrapping calls to parse_token_from_header with explicit input length and format validation before passing to the library can limit exploitability, though this introduces ongoing maintenance burden. See VulDB advisory at https://vuldb.com/vuln/387216 for additional technical context.
More in Oidc Authorizer
View allSame weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today