PT-2026-37315 · Ciguard · Ciguard

Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-44219

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ciguard versions 0.6.0 through 0.8.1

Description Both SCA HTTP clients in src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call the function json.loads() on response data without a maximum-bytes cap. A hostile or compromised server, or a successful TLS Man-in-the-Middle (MITM) attack, could return an excessively large response, leading to memory exhaustion and causing the process to be killed by the operating system (OOM kill) or resulting in system swap thrashing. This is particularly critical when the software runs in CI environments with limited memory budgets.

Recommendations Update ciguard to version 0.8.2.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-44219

GHSA-XW8C-RRVX-F7XQ

Affected Products

Ciguard

References · 7

• 🔥 https://github.com/Jo-Jo98/ciguard/security/advisories/GHSA-xw8c-rrvx-f7xq · Exploit
• https://osv.dev/vulnerability/GHSA-xw8c-rrvx-f7xq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44219 · Security Note
• https://twitter.com/CVEnew/status/2054324075989000444 · Twitter Post
• https://github.com/Jo-Jo98/ciguard/releases/tag/v0.8.2 · Note
• https://github.com/Jo-Jo98/ciguard · Note
• https://github.com/Jo-Jo98/ciguard/releases/tag/v0.8.3 · Note