N1QL Injection Part 8

Couchbase Server Memory Exhaustion

While investigating the UNCOMPRESS() function for compression bomb style attacks (see Part 7), I started wondering if any of the other functions could be used to perform similar memory exhaustion attacks against new and old versions of Couchbase Server.

My first thought was to use the REPEAT function, since it would allow us to repeat an arbitrarily large string as many times as possible. However, the developers at Couchbase suspected that this function might be abused in this manner and have implemented a check to ensure that the resulting string does not exceed the maximum length of 20971520 bytes (20MB).

Query:
select REPEAT('A',20971521)

Output:
[
  {
    "code": 5010,
    "msg": "Error evaluating projection",
    "reason": {
      "_level": "exception",
      "caller": "util:24",
      "cause": {
        "element_count": 20971521,
        "element_size": 1,
        "limit": 20971520,
        "size": 20971521,
        "term_type": "repeat()"
      },
      "code": 5037,
      "key": "execution.size_error",
      "message": "Size of repeat() result exceeds limit (20971521 > 20971520)."
    }
  }
]

My next thought was: “Are there functions similar to REPEAT that don’t have this size limit?”, and to my surprise the answer was a resounding: Yes! Four of them.

Specifically the padding functions:

  • LPAD
  • RPAD
  • MB_LPAD
  • MB_RPAD

These functions take the following arguments:

  • input string - The string to add the leading characters to
  • size - The desired length of the final string as an integer
  • padding character - The character to add to the input string to create the final output

While the size parameter used in other functions (e.g. REPEAT) has a limit to prevent misuse, the size parameter of the padding functions does not have any limit allowing any positive integer value to be supplied. That being said, similar to the UNCOMPRESS compression bomb issue, setting a size value beyond the memory limit of server does not result in a more effective attack. A string length of 60-80% of the server’s available memory seemed to be more reliable, but the amount of time the server would be disrupted for varied from a few minutes to a few hours.

Proof of Concept

Query:

select RPAD('felsec',10737418240,'A')

Resulting Memory Exhaustion:

The screenshot below shows the remote server’s resources being consumed and the environment becoming unresponsive. (The screenshot was taken approximately 30 minutes after the query began execution).

Memory Exhaustion - Btop

What is the impact?

A successful and sustained attack would render the server unusable and prevent other queries from executing or completing successfully.

What to do about it?

Upgrade to the latest version of Couchbase Server.

Configure per-request memory quotas in line with Couchbase’s recommendations (more details here: Query Service Memory Management in Couchbase) and the application’s requirements.

Note: This vulnerability could be triggered even if the per server query memory quota had been configured. Per query memory quotas did prevent the memory exhaustion from occurring when a single query was sent, however sending multiple queries in quick succession or in parallel would still lead to a server’s resources being consumed.

Disclosure Timeline

This vulnerability was disclosed to Couchbase on the 23rd May 2026 via their “Report a Vulnerability” form. To this date the issue has not been acknowledged by Couchbase and subsequent attempts to reach out to them have been unsuccessful.

References