Description

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T22:17:15.760Z",
  "pubdate": "2026-08-12T22:17:15.760Z",
  "executiveSummary": "A memory exhaustion vulnerability exists within the search-v2-api product, specifically affecting the tokenReviews cache component.\nThe flaw allows unauthenticated remote attackers to trigger a Denial of Service (DoS) condition against the target system.\nBy repeatedly submitting requests containing unique, randomly generated bearer tokens, an adversary can exhaust the available memory resources of the search-api pod.\nThe root risk stems from a lack of proper cache management, bounding, or eviction mechanisms for the tokenReviews cache, causing every unique submission to persist indefinitely as a permanent entry.\nThis vulnerability requires no prior authentication or elevated privileges, lowering the barrier to exploitation and enabling network-based disruption of service availability.\nSuccessful exploitation ultimately degrades system performance and leads to application crashes due to out-of-memory errors.",
  "technicalDetails": "The vulnerability resides in the request handling and validation logic of search-v2-api, specifically within the subsystem managing token validation and the tokenReviews cache.\nThe affected component fails to implement proper resource bounding, Time-To-Live (TTL) expiration, or Least Recently Used (LRU) eviction policies for cached authentication tokens.\nWhen an unauthenticated client sends an HTTP request containing a bearer token, the application processes the token and caches the evaluation result inside the unbounded tokenReviews cache.\nBecause the application does not validate whether the provided token is structurally valid, reusable, or previously encountered before caching, each request utilizing a uniquely randomized bearer token forces the underlying system to allocate and retain new memory entries indefinitely.\nThe step-by-step attack flow begins with the attacker script generating a continuous stream of distinct, high-entropy random strings formatted as bearer tokens.\nThe attacker transmits these crafted requests over the network to the exposed endpoints of the search-v2-api service without requiring any authentication credentials or session tokens.\nUpon receiving the requests, the vulnerable function processes each unique token and inserts a corresponding record into the tokenReviews cache.\nBecause the cache lacks an upper size limit or automatic cleanup routines, memory consumption grows linearly with the rate and volume of incoming unique requests.\nOver time, continuous payload injection exhausts the available heap memory allocated to the search-api pod.\nThis resource depletion eventually triggers runtime memory limits, resulting in container termination, service crashes, and a complete Denial of Service (DoS) for legitimate users relying on the search infrastructure."
}