Pre-authentication denial of service in X-Road signature verification
X-Road Security Server (< 7.8.2)
A registered X-Road ecosystem member could send a small crafted message that forces a peer Security Server to burn CPU resolving an attacker-controlled batch-signature hash chain — before any signature or certificate is checked — exhausting the message-processing thread pool and disrupting data exchange.
Severity: Medium CVSS 6.5 GHSA-rc33-88jw-c5jp 4 min read
Every score is built from eight plain questions about how an attack works and what it costs you.
How hard it is to exploit
What the attacker can do
Select a metric to see what it means
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
§ 01. Overview
X-Road is the open-source data-exchange layer that underpins national interoperability platforms in Estonia, Finland, Iceland and many other jurisdictions. Members exchange signed, time-stamped messages through Security Servers, which act as the trust boundary between an organization's information systems and the wider ecosystem. To keep qualified digital signatures cheap at scale, X-Road supports batch signatures: many messages are signed together and each individual message is proven to belong to the batch by a hash chain that the receiver re-walks and verifies.
This advisory concerns the receiving side of that mechanism. The HashChainVerifier component in the common-message module resolves an incoming batch-signature hash chain with no cycle detection, no depth limit, no cap on the total number of resolved steps, and no per-step memoization. Because the hash chain is fully attacker-controlled and is resolved before the signature and certificate are verified, a peer can be driven into heavy or unbounded computation without ever presenting a valid signature.
§ 02. How it works
A hash chain is a small XML structure whose steps reference other steps. A well-formed chain is a shallow, acyclic graph that resolves in a handful of steps. The verifier, however, followed those references naively. With no memoization, a step that is referenced from two places is recomputed each time it is reached; by nesting such double-references at every level, an attacker constructs a chain of only a few kilobytes whose resolution fans out exponentially, so a tiny request maps to an enormous amount of CPU work.
A second, simpler variant exploits the missing cycle detection: a step that references itself (or forms a loop with another step) sends the resolver into unbounded recursion. Depending on the path, that manifests either as effectively non-terminating work or as an uncaught error thrown out of the verification routine.
The ordering is what makes this cheap to trigger. The hash-chain resolution runs ahead of signature and certificate verification, so the expensive step is reached pre-authentication in the message-processing sense — the attacker never has to hold a valid signature over the crafted chain. Any party already registered in the X-Road ecosystem, which is the realistic threat model for a shared data-exchange fabric, can send such a request to a target Security Server.
§ 03. Impact
Each malicious request pins a message-processing thread on the target Security Server while it grinds through the crafted chain. A small number of concurrent or repeated requests is enough to consume the proxy thread pool, at which point legitimate messages queue and time out and the server stops moving traffic. The result is a denial of service against the data-exchange service — reflected in the CVSS vector as availability-only impact (A:H) with no effect on confidentiality or integrity (C:N/I:N).
In a national interoperability setting the affected component is a shared dependency: a single member abusing the flaw can degrade exchange for the organizations that route through, or depend on, the targeted Security Server. The low attack complexity and the fact that only ordinary ecosystem membership is required (PR:L) are what keep the score at 6.5 despite the limited impact dimension.
§ 04. Affected and fixed versions
All X-Road Security Server releases prior to 7.8.2 are affected. The issue is fixed in 7.8.2 and back-ported to the maintained release lines as 7.7.3 and 7.6.4. Operators should upgrade to the patched release on their line.
The fix constrains the hash-chain resolver so that adversarial input can no longer translate into unbounded work: bounding the traversal (depth and total resolved steps), detecting cycles rather than recursing into them, and eliminating the repeated recomputation that produced the exponential blow-up. This caps the cost of verifying any incoming chain regardless of how it is shaped.
§ 05. Disclosure
The issue was reported to the Nordic Institute for Interoperability Solutions (NIIS) through coordinated disclosure by OffSeq and is published as GitHub Security Advisory GHSA-rc33-88jw-c5jp. No CVE identifier was assigned. Credit for the finding goes to OffSeq.
§ 06. Disclosure timeline
- 2026-06-24 Reported to NIIS through coordinated disclosure by OffSeq
- 2026 Fixed in X-Road 7.8.2, 7.7.3 and 7.6.4; advisory published