CVE-2023-45810mediumCWE-400

CVE-2023-45810: medium-severity vulnerability in openfga

OpenFGA denial of service

Published · Updated

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
In short

OpenFGA, an authorization engine, can become unresponsive when many ListObjects requests are made because the application fails to properly release memory and resources after responding to these requests. An attacker can send enough of these requests to make the service unavailable to legitimate users.

Technical detail

OpenFGA versions prior to 1.3.4 contain a resource exhaustion vulnerability (CWE-400) in the ListObjects operation where response handling does not properly deallocate memory and system resources. An unauthenticated remote attacker can trigger a denial of service by sending a high volume of ListObjects requests, causing cumulative resource consumption and eventual service unavailability.

Summary generated and translated by AI from the official description.
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%