CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716

Valhalla (open source routing engine for OpenStreetMap data) versions 3.7.0 and earlier are vulnerable to a denial-of-service via the /sources_to_targets endpoint. A single unauthenticated POST request containing an exclude_polygons ring formed by three collinear points (zero-area geometry) trigg...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716: Allocation of Resources Without Limits or Throttling

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...