Log in Start free

Vulnerability · Published May 8, 2024 · Assigned by GitHub_M

CVE-2024-32886Vitess vulnerable to infinite memory consumption and vtgate crash

Medium 4.9

In plain English

A medium-severity infinite loop in vitess from vitessio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/vitessio/vitess19.0.4GHSA-649x-hxfx-57j2
Gogithub.com/vitessio/vitess18.0.5GHSA-649x-hxfx-57j2
Gogithub.com/vitessio/vitess17.0.7GHSA-649x-hxfx-57j2
Govitess.io/vitess0.17.7GHSA-649x-hxfx-57j2
Govitess.io/vitess0.18.5GHSA-649x-hxfx-57j2
Govitess.io/vitess0.19.4GHSA-649x-hxfx-57j2
Govitess.io/vitess0.17.7, 0.18.5, 0.19.4GO-2024-2826

Affected products (as reported)

VendorProductVersions
vitessio vitess < 17.0.7>= 18.0.0, < 18.0.5>= 19.0.0, < 19.0.4

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References