CVE-2026-44219 ciguard: SCA HTTP client reads response body without size cap
A malicious or compromised upstream service can cause memory exhaustion in ciguard by returning excessively large HTTP responses, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44219?
CVE-2026-44219 is a low-severity denial of service vulnerability in Jo-Jo98 ciguard, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py) call payload = json.loads(resp.read().decode('utf-8')) without a maximum-bytes cap. A hostile or compromised endoflife.date / OSV.dev (or a successful TLS MITM) could return a multi-GB response, exhausting the ciguard process's memory. This vulnerability is fixed in 0.8.2.
Weakness: CWE-770
Which versions are affected by CVE-2026-44219?
3 open source packages ship an affected version, including ciguard.
| Package | Affected | Fixed in |
|---|---|---|
ciguard PyPI | From 0.6.0 | 0.8.2 |
ciguard PyPI | From 0.6.0 | 0.8.2 |
ciguard PyPI | From 0.6.0 | 0.8.2 |
How do I fix CVE-2026-44219?
Upgrade ciguard to 0.8.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44219 exists.
Sources
Also known as GHSA-xw8c-rrvx-f7xq, PYSEC-2026-2410.