CVE Record: CVE-2023-45810

alert

Notice: Keyword searching of CVE Records is now available in the search box above. Keywords may include a CVE ID (e.g., CVE-2024-1234), or one or more keywords separated by a space (e.g., authorization, SQL Injection, cross site scripting, etc.). Learn more here.

alert

Notice: Keyword searching of CVE Records is now available in the search box above. Keywords may include a CVE ID (e.g., CVE-2024-1234), or one or more keywords separated by a space (e.g., authorization, SQL Injection, cross site scripting, etc.). Learn more here.

Expand or collapse notification button

Required CVE Record Information

Description

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

CWE 1 Total

CWE-400: CWE-400: Uncontrolled Resource Consumption

CVSS 1 Total

Product Status

Versions 1 Total

Default Status: unknown

affected

References 1 Total

github.com: https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq
external site

Updated: 2024-08-02

This container includes required additional information provided by the CVE Program for this vulnerability.

References 1 Total

github.com: https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq
external site
x_transferred

Authorized Data Publishers