Vulnerability · Published Jan 26, 2024 · Assigned by GitHub_M

CVE-2024-23820OpenFGA DoS

Medium 5.3

In plain English

A medium-severity resource allocation without limits in openfga from openfga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openfga/openfga	1.4.3	GHSA-rxpw-85vw-fx87
Go	github.com/openfga/openfga	1.4.3	GO-2024-2477

Affected products (as reported)

Vendor	Product	Versions
openfga	openfga	< 1.4.3

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87 x_refsource_CONFIRM
https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39 x_refsource_MISC
https://github.com/openfga/openfga/releases/tag/v1.4.3 x_refsource_MISC