CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets
An unauthenticated attacker can cause a denial of service in Valhalla by sending a POST request with degenerate exclude_polygons, triggering unbounded memory growth.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54716?
CVE-2026-54716 is a high-severity denial of service vulnerability in valhalla, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.
Weakness: CWE-770
Which versions are affected by CVE-2026-54716?
How do I fix CVE-2026-54716?
No fix has been published for CVE-2026-54716 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54716 being exploited?
There is no known exploitation of CVE-2026-54716 in the wild and no public exploit code.
Sources
Also known as GHSA-qpf6-xp29-pg6r.