CVE-2026-54716: Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygonsearch.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept excludepolygons, including /route, were not verified as affected. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Valhalla 3.7.0 or earlier with a publicly reachable /sources_to_targets endpoint are exposed, because a single unauthenticated POST request can terminate a worker. The issue is specifically verified for /sources_to_targets; other endpoints that accept exclude_polygons, including /route, were not verified as affected.
What does an attacker need to send?
An attacker needs only to submit a POST request containing an exclude_polygons ring made of three collinear points. No authentication or user interaction is required, and the zero-area geometry is the trigger rather than other request options.
What can be done while no fixed version is available?
Restrict or filter access to /sources_to_targets where possible, particularly for untrusted clients. Reject requests whose exclude_polygons rings have zero area or consist of three collinear points before they reach Valhalla.
How can I determine whether a worker has been affected?
Affected workers exhibit unbounded memory growth while processing a /sources_to_targets request with the malformed exclude_polygons ring, followed by termination by the out-of-memory killer. Review worker memory metrics and system logs for OOM-killer termination around such requests.