Versity panic induced by AWS chunked data sent to port
Date: 2025-08
Affected: go/github.com/versity/versitygw
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CWE: CWE-476

Sending AWS chunk data with no Content-Length HTTP header causes the panic, every time. ### Reproduction Setup versity server running on port 7071, no SSL (for ease of packet tracing with tshark). Problem can be reproduced with or without SSL on the versity end. Use nginx to reverse proxy on port 7070. This does have to be SSL enabled for the repro to occur. nginx config: ``` upstream tony_versity { server 127.0.0.1:7071; keepalive 15; } server { listen 7070 ssl ; access_log /var/log/nginx/tony_versity_proxy.access.log; error_log /var/log/nginx/tony_versity_proxy.error.log; # Allow any size file to be uploaded. client_max_body_size 0; # Allow special characters in headers ignore_invalid_headers off; # Disable buffering proxy_buffering off; proxy_request_buffering off; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; ssl_certificate "/WS/TEMP/lh.crt"; ssl_certificate_key "/WS/TEMP/lh.key"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; ssl_protocols TLSv1.2 TLSv1.3; location / { allow all; proxy_pass http://127.0.0.1:7071; proxy_http_version 1.1; proxy_read_timeout 120; proxy_connect_timeout 300; # Set headers proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr;


Mitigations:

Architectural layers (MAESTRO):