Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54716

Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54716

Published

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54716

Published

valhalla

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "valhalla",
                    "product": "valhalla",
                    "versions": [
                        {
                            "version": "<= 3.7.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON