Agelanserver
Monthly
Remote unauthenticated denial of service in ageLANServer prior to 1.15.2 lets any network-reachable client crash or hang the bundled AoE3 game server by sending an oversized request to the POST /game/cloud/getFileURL endpoint. Because the handler enforces neither a request body size cap nor a bound on the attacker-controlled JSON 'names' array, and sizes response allocations directly from that array length, a single large payload drives excessive memory allocation, processes crash or stall, active players are disconnected, and the service stays down until it is restarted. The default self-registration flow is enabled out of the box, so no credentials or non-default configuration are required; impact is confined to availability, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis. The issue is fixed in version 1.15.2.
Remote unauthenticated denial of service in ageLANServer prior to 1.15.2 lets any network-reachable client crash or hang the bundled AoE3 game server by sending an oversized request to the POST /game/cloud/getFileURL endpoint. Because the handler enforces neither a request body size cap nor a bound on the attacker-controlled JSON 'names' array, and sizes response allocations directly from that array length, a single large payload drives excessive memory allocation, processes crash or stall, active players are disconnected, and the service stays down until it is restarted. The default self-registration flow is enabled out of the box, so no credentials or non-default configuration are required; impact is confined to availability, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis. The issue is fixed in version 1.15.2.