Description

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T20:17:14.330Z",
  "pubdate": "2026-09-11T20:17:14.330Z",
  "executiveSummary": "AirSane versions prior to 0.4.12 are vulnerable to a Denial of Service (DoS) attack originating from improper memory management within the custom HTTP server implementation.\nThe vulnerability stems from the absence of input validation on the 'Content-Length' header, allowing an unauthenticated remote attacker to trigger an out-of-memory (OOM) condition via a malformed HTTP POST request.\nBy submitting an arbitrarily large integer in the 'Content-Length' field, an attacker can force the application to attempt memory allocation exceeding available system resources.\nThis leads to an unhandled std::bad_alloc exception, causing the immediate termination of the AirSane scanner server process.\nThe flaw also extends to improper handling of non-numeric characters in the header, which results in undefined behavior during parsing.\nGiven the lack of authentication requirements, the vulnerability presents a significant risk to service availability for exposed AirSane instances.\nExploitation is trivial and does not require elevated privileges, as the impact is realized at the application level during the initial request parsing phase.",
  "technicalDetails": "The vulnerability resides within the HttpServer::Request::content function located in httpserver.cpp.\nThe root cause is a lack of bounds checking and robust error handling when processing the 'Content-Length' HTTP header.\nWhen the AirSane daemon receives an HTTP POST request, it extracts the 'Content-Length' value and directly passes it as an argument to the std::string::resize() method.\nBecause the input is not validated against a defined maximum threshold, the application allocates memory based entirely on the attacker-supplied value.\nAn attacker can exploit this by sending a specially crafted POST request containing an excessively large 'Content-Length' header (e.g., several gigabytes).\nUpon receiving the request, the daemon attempts to pre-allocate a buffer of the specified size; this operation triggers an std::bad_alloc exception when the request size exceeds the available heap or virtual memory limits.\nSince this exception is not properly caught or handled, the process crashes, resulting in a successful denial of service.\nFurthermore, the parsing logic lacks validation for non-numeric input. When non-numeric characters are provided, the conversion to an integer type is performed without error checking, leading to undefined behavior and potential corruption of the parsing logic before the allocation occurs.\nThe attack is performed over the network using the Apple AirScan protocol (or the associated HTTP interface), requiring no prior authentication or administrative privileges.\nThe vulnerability affects all AirSane versions prior to 0.4.12, which specifically introduces the necessary input validation to sanitize header values and constrain memory allocation requests."
}