CVE-2026-54716 valhalla CVE debrief

Who should care

Defenders responsible for Valhalla instances, particularly those exposed to the internet, should assess their exposure and prioritize patching or mitigating the vulnerability. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-54716 is a high-severity vulnerability in Valhalla that allows an unauthenticated attacker to cause a denial of service. Defenders should prioritize verifying and patching affected instances, particularly those exposed to the internet, and monitor for similar attacks on other endpoints that accept exclude_polygons.

• Potential denial of service for public-facing workers
• Need for verification of affected versions and exposure
• Priority for patching or mitigating the vulnerability
• Potential for similar attacks on other endpoints

Technical summary

The vulnerability is caused by a flaw in the src/loki/polygon_search.cc file, which processes the exclude_polygons ring in the request. A single unauthenticated request can cause the worker to terminate due to out-of-memory. The issue is particularly concerning for instances exposed to the internet, as it can result in a denial of service. Defenders should prioritize verifying and patching affected Valhalla instances, particularly those exposed to the internet, and monitor for similar attacks on other endpoints that accept exclude_polygons. The vulnerability is triggered by a specific type of request to the /sources_to_targets endpoint.

Defensive priority

Defenders should prioritize verifying and patching affected Valhalla instances, particularly those exposed to the internet, and monitor for similar attacks on other endpoints that accept exclude_polygons.

Recommended defensive actions

• Verify and patch affected Valhalla instances
• Monitor for similar attacks on other endpoints that accept exclude_polygons
• Restrict access to the /sources_to_targets endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is triggered by a specific type of request to the /sources_to_targets endpoint, and other endpoints that accept exclude_polygons were not verified as affected. No fixed version is available as of this review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.