GitHub Advisoryadvisory · Go

GHSA-hr4f-6jh8-f2vq OpenFGA DoS vulnerability

HIGH Published 2023-10-18 Modified 2023-10-25 Official page ↗
Aliases
CVE-2023-45810
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-10-18

Affected packages

• Go github.com/openfga/openfga: < 1.3.4 → fixed in 1.3.4

Description

Overview OpenFGA is vulnerable to a DoS attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and the service as a whole becomes unresponsive. Fix Upgrade to v1.3.4. This upgrade is backwards compatible.

Related

Alias · CVE (1)

  • CVE-2023-45810 OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References