CVE-2023-35933mediumCWE-835

CVE-2023-35933: medium-severity vulnerability in openfga

OpenFGA denial of service die to circular relationship

Published · Updated

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 1.1%
In short

OpenFGA versions 1.1.0 and earlier crash when processing authorization checks or object listings against models with circular relationships, causing the service to become unavailable.

Technical detail

A denial of service vulnerability exists in OpenFGA v1.1.0 and prior when Check or ListObjects API calls are made against authorization models containing circular relationship definitions, triggering infinite loops (CWE-835) that exhaust resources and crash the service. The attack requires the attacker to submit legitimate API calls to a vulnerable OpenFGA instance; no authentication bypass is needed if the API is exposed.

Summary generated and translated by AI from the official description.
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%