Listen to this Post
The vulnerability exists within the Snappy compression block decoder in affected versions of VictoriaMetrics. The decoder fails to properly validate the size of incoming compressed blocks against the configured `MaxRequestSize` limit. An attacker can craft and send a malicious Snappy-compressed HTTP request containing a block that declares a large decompressed size. During the decompression process, the decoder allocates memory based on this declared size before the actual decompression and size validation occur. By sending a request with a block that has a small compressed size but an excessively large declared uncompressed size, the attacker can trigger a massive, uncontrolled memory allocation. This bypasses the intended `MaxRequestSize` protection, leading to an Out-of-Memory (OOM) condition and Denial-of-Service (DoS) for the VictoriaMetrics instance.
Platform: VictoriaMetrics
Version: 1.123.0-1.129.0
Vulnerability: DoS
Severity: Low
date: 2025-11-25
Prediction: 2025-11-29
What Undercode Say:
Simulating memory allocation for a malicious block ./victoria-metrics -maxInsertRequestSize=64KB Crafting a malicious snappy block with a large declared size echo "malformed_data" | snappy compress | dd bs=1 count=64 Small compressed payload The server allocates memory for the large declared size, e.g., 2GB, causing OOM.
// Example vulnerable code path (conceptual)
func decodeSnappyBlock(data []byte) ([]byte, error) {
// Missing early check against MaxRequestSize for the decompressed size
decodedLen := binary.Uint32(data[0:4]) // Attacker-controlled large value
buf := make([]byte, 0, decodedLen) // Excessive allocation occurs here
// ... decompression logic later ...
}
How Exploit:
Craft malicious Snappy request.
Send to VictoriaMetrics endpoint.
Trigger massive memory allocation.
Cause Out-of-Memory crash.
Protection from this CVE
Update to patched versions.
Enforce network access controls.
Configure resource limits.
Impact:
Service Denial of Service.
Uncontrolled memory consumption.
Potential system instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
