GSSA-2026-04-3ZVC5DGITLAB-GSSA-2026-04-3ZVC5DApril 25, 20266.5 Medium
Unbounded pagination limits enable resource exhaustion in cobc-events
Several REST endpoints accepted a client-controlled `limit` query parameter with no upper bound, allowing authenticated users to request arbitrarily large result sets and exhaust database / memory.
Affected (1)
- gelhaus-solutionscobc-events
- ≥ 0.0.0Fixed in 1.0.1
Mitigations
Workarounds
- Apply a WAF rule rejecting `limit` query parameters above a sensible maximum.
- Lower `express-rate-limit` thresholds for affected routes.
Solutions
- Upgrade cobc-events to 1.0.1 or later.
Overview
Several REST endpoints accepted a client-controlled limit query parameter with no upper bound, allowing authenticated users to request arbitrarily large result sets and exhaust database / memory.
Severity
CVSS v3
6.5 Medium
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weaknesses (3)
References (3)
- New pagination helper (Patch)
- Pagination cap on /api/logs (Patch)
- Pagination cap on /api/events (Patch)
Credits (5)
- Enno GelhausFinder · egelhaus@ennogelhaus.de
- Enno GelhausAnalyst · egelhaus@ennogelhaus.de
- Enno GelhausRemediation developer · egelhaus@ennogelhaus.de
- Enno GelhausRemediation reviewer · egelhaus@ennogelhaus.de
- Claude (Anthropic) — automated audit assistantTool · https://claude.com
Context
Impacts
Denial of service via unbounded list queries
CAPEC-130
Timeline
- 04/25/2026 00:00
Internal security audit started
- 04/25/2026 06:00
Vulnerability identified during audit
- 04/25/2026 12:00
Patch developed and merged to main
- 04/25/2026 14:00
cobc-events 1.0.1 released
- 04/25/2026 15:00
Advisory published