CVE-2026-70616 boringproxy CVE debrief

Who should care

Users and administrators of boringproxy through 0.10.0, especially those with exposed instances or high-risk environments, should prioritize patching and monitoring. This includes reviewing current deployments, assessing potential exposure, and implementing compensating controls where necessary. Security teams should also monitor for potential exploitation attempts and review logs for suspicious activity related to the GET /loading endpoint. Additionally, operators of platforms using boringproxy should ensure that their configurations are secure and up-to-date, and consider implementing rate limiting or IP blocking to mitigate potential attacks.

Technical summary

The CVE-2026-70616 vulnerability in boringproxy through 0.10.0 allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. The handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts.

Defensive priority

CVE-2026-70616 is rated HIGH with a CVSS score of 7.1, indicating a serious vulnerability that could allow an authenticated user to cause a resource exhaustion attack against a server running boringproxy through 0.10.0.

Recommended defensive actions

• Review and apply vendor patches or updates for boringproxy to version 0.10.1 or later.
• Implement rate limiting and monitoring for the GET /loading endpoint.
• Restrict access to the GET /loading endpoint to only necessary users and services.
• Consider implementing additional security measures such as IP blocking or user authentication.
• Monitor server resource utilization and implement alerts for potential resource exhaustion attacks.

Evidence notes

The CVE-2026-70616 vulnerability in boringproxy through 0.10.0 allows any authenticated user to permanently exhaust server resources by sending malicious requests to the GET /loading endpoint. Evidence is based on a limited source corpus; further verification is recommended. The handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts. This issue can cause serious resource exhaustion, potentially leading to denial-of-service conditions. Users should verify their deployments and consider immediate patching.

Official resources