GHSA-j7jw-28jm-whr6MediumCVSS 6.5

lakeFS allows an authenticated user to cause a crash by exhausting server memory

Published
February 21, 2025
Last Modified
February 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-27100 →

📋 Description

Impact

An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.

Patches

This problem has been patched and exists in versions 1.49.1 and below

Workarounds

On S3 backends, configure

# ...
blockstore:
  s3:
    disable_pre_signed_multipart: true

or set environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true.

References

Are there any links users can visit to find out more?

🎯 Affected products1

  • go/github.com/treeverse/lakefs:< 1.50.0

🔗 References (4)