GHSA-rxpw-85vw-fx87MediumCVSS 5.3

OpenFGA denial of service

Published
January 26, 2024
Last Modified
February 1, 2024

🔗 CVE IDs covered (1)

CVE-2024-23820 →

📋 Description

Overview

OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.

Fix

Upgrade to v1.4.3. This upgrade is backwards compatible.

🎯 Affected products1

  • go/github.com/openfga/openfga:< 1.4.3

🔗 References (5)