GHSA-v2ch-c8v8-fgr7: Versity panic induced by AWS chunked data sent to port

August 29, 2025 (updated November 10, 2025)

Sending AWS chunk data with no Content-Length HTTP header causes the panic, every time.

References

github.com/advisories/GHSA-v2ch-c8v8-fgr7
github.com/versity/versitygw
github.com/versity/versitygw/commit/0972af078325ab5c6acd37abffe6bea345ac7db0
github.com/versity/versitygw/issues/1418
github.com/versity/versitygw/security/advisories/GHSA-v2ch-c8v8-fgr7

Code Behaviors & Features

Detect and mitigate GHSA-v2ch-c8v8-fgr7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →