Problem
The gateway's pre-auth bootstrap-token verify path takes a process-wide mutex and runs verification work without a rate limit or lockout. An unauthenticated attacker can flood the bootstrap-token endpoint with bogus tokens to stall the mutex and starve legitimate auth traffic.
Documented as part of the bootstrap DoS audit in #76322.
Tracking PR
Fix in #77527.
Problem
The gateway's pre-auth bootstrap-token verify path takes a process-wide mutex and runs verification work without a rate limit or lockout. An unauthenticated attacker can flood the bootstrap-token endpoint with bogus tokens to stall the mutex and starve legitimate auth traffic.
Documented as part of the bootstrap DoS audit in #76322.
Tracking PR
Fix in #77527.