Description

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of the component Authorization Header Parsing. The manipulation of the argument authorization_token leads to denial of service. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T18:16:43.117Z",
  "pubdate": "2026-08-09T18:16:43.117Z",
  "executiveSummary": "A denial of service vulnerability has been identified in lmammino oidc-authorizer version 0.4.0, specifically residing within the authorization header parsing component. The flaw is triggered via the manipulation of the authorization_token argument processed by the parse_token_from_header function located in src/parse_token_from_header.rs. Remote attackers can exploit this vulnerability over the network without requiring prior authentication or elevated privileges, leading to service degradation or complete service unavailability.\nThe risk implications are severe for applications relying on the affected component for authentication and authorization processing, as a crafted input can exhaust system resources or trigger unhandled execution paths. Public disclosure of the exploit vector increases the likelihood of active targeting. The vendor was notified of the security issue but failed to provide a response or official patch, leaving deployments exposed unless manual defensive measures or compensating controls are implemented.",
  "technicalDetails": "The vulnerability stems from improper input validation and handling within the authorization header parsing logic implemented in the parse_token_from_header function of the src/parse_token_from_header.rs file. When an unauthenticated remote attacker supplies a maliciously crafted authorization_token via network requests, the parsing routine fails to safely process the malformed structure. This improper handling results in a denial of service condition, likely due to algorithmic complexity issues, excessive memory consumption, or application panic caused by parsing failures within the Rust runtime environment.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious HTTP authorization header containing the anomalous authorization_token string. Second, the attacker transmits this crafted request over the network to the service utilizing lmammino oidc-authorizer version 0.4.0. Third, the request reaches the authorization layer where parse_token_from_header processes the malicious argument. Fourth, the insecure parsing mechanism encounters the malformed input, triggering the denial of service state that disrupts processing for subsequent incoming requests. Network exposure is direct, as the authorization header parsing component is typically exposed to external clients attempting to authenticate against the protected API or service endpoints."
}