Vulnerability · Published Aug 21, 2023 · Assigned by mitre
CVE-2023-38976
High 7.5
In plain English
A high-severity security flaw in the github.com/weaviate/weaviate package (Go). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/weaviate/weaviate | 1.20.6 | GHSA-8697-479h-5mfp |
| Go | github.com/weaviate/weaviate | 1.19.13 | GHSA-8697-479h-5mfp |
| Go | github.com/weaviate/weaviate | 1.18.6 | GHSA-8697-479h-5mfp |
| Go | github.com/weaviate/weaviate | 1.18.6, 1.19.13, 1.20.6 | GO-2023-2017 |