CVEvulnerability

CVE-2024-39702

5.9 MEDIUM Published 2024-07-23 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-07-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407

Description

In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in the openresty/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected.

Affected configurations

• openresty openresty (>= 1.19.3.1 < 1.19.9.2) • openresty openresty (>= 1.21.4.1 < 1.21.4.4) • openresty openresty 1.25.3.1

Related

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

References