CVE-2025-47908

What it actually does

The middleware performs excessive heap allocations when parsing an Access-Control-Request-Headers header containing many commas in a CORS preflight request, leading to high memory consumption and potential denial of service.

Why it matters to the business

Attackers can cause targeted servers to consume disproportionate memory and become unavailable, disrupting service availability for applications relying on the affected middleware.

How an attack unfolds

An attacker crafts an HTTP OPTIONS preflight request containing an Access-Control-Request-Headers header whose value consists of many comma-separated tokens; the middleware allocates memory for each token without sufficient limits, rapidly exhausting resources on the server.

How to fix it

Upgrade all affected packages to the fixed versions: kuma-2.10 (Chainguard) 2.10.5-r2, kuma-cni-2.10 (Chainguard) 2.10.5-r2, kuma-cni-compat-2.10 (Chainguard) 2.10.5-r2, kuma-cp-2.10 (Chainguard) 2.10.5-r2, kuma-dp-2.10 (Chainguard) 2.10.5-r2, kuma-install-cni-2.10 (Chainguard) 2.10.5-r2, kumactl-2.10 (Chainguard) 2.10.5-r2. Apply patches or configuration limits on header parsing if upgrades are delayed.

How to confirm the fix worked

Verify deployed package versions match or exceed the listed fixed releases; replay a test preflight request containing an Access-Control-Request-Headers header with a large number of commas and confirm memory usage remains bounded.

Typical attack path

1. Identify an endpoint protected by the vulnerable middleware
2. Send a crafted CORS preflight OPTIONS request with an Access-Control-Request-Headers header containing thousands of comma-separated values
3. Observe repeated requests that trigger repeated allocation spikes until memory pressure causes slowdown or crash

How to detect it

Inspect web server or application logs for CORS preflight requests that contain unusually long Access-Control-Request-Headers values; correlate with memory or CPU spikes on the middleware process.

• OPTIONS request with Access-Control-Request-Headers containing hundreds of commas
• Repeated preflight requests from the same source IP with expanding header length

What your security team should do

• Prioritize immediate upgrade of all listed Kuma packages to the 2.10.5-r2 fixed releases
• Implement request size or header-value limits at the load balancer or reverse proxy as a temporary control
• Monitor memory usage and request rates for the affected middleware services