CVE-2026-54716 valhalla CVE debrief

Who should care

Defenders responsible for public-facing workers and systems using Valhalla version 3.7.0 or earlier should assess their exposure to this vulnerability. Prioritization is recommended for verifying exposure and preparing for potential impacts, especially for those with unauthenticated access to the affected endpoints.

Why it matters

CVE-2026-54716 is a high-severity vulnerability in Valhalla that can lead to worker termination via a crafted request. Defenders should prioritize verifying exposure, especially for public-facing workers, and prepare for remediation once a fixed version is available. The vulnerability's impact on other endpoints and versions requires verification.

• Potential termination of public-facing workers via a single unauthenticated request
• Possible impact on other endpoints accepting exclude_polygons, requiring verification
• Need for verification of affected versions and exposure
• Remediation priority once a fixed version is released

Technical summary

The vulnerability in Valhalla, tracked as CVE-2026-54716, allows for unbounded memory growth in the worker process when a POST request to /sources_to_targets contains an exclude_polygons ring formed by three collinear points. This can lead to the termination of a public-facing worker by the out-of-memory killer. The issue affects Valhalla version 3.7.0 and earlier. Other endpoints accepting exclude_polygons, such as /route, have not been verified as affected. Currently, no fixed version is available.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially for public-facing workers, and monitor for potential impacts on other endpoints that accept exclude_polygons. Remediation efforts should focus on updating affected versions once a fixed version is released.

Recommended defensive actions

• Verify exposure to this vulnerability, especially for public-facing workers
• Monitor for potential impacts on other endpoints that accept exclude_polygons
• Update affected versions once a fixed version is released
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A GitHub security advisory also discusses the issue. Defenders should verify exposure, especially for public-facing workers, and monitor for potential impacts on other endpoints that accept exclude_polygons. The vulnerability allows for unbounded memory growth in the worker process when a POST request to /sources_to_targets contains an exclude_polygons ring formed by three collinear points. This can lead to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.