{"cve":"CVE-2023-50709","nvd":{"published":"2023-12-13T22:15:43.620","modified":"2026-06-17T06:39:49.663","status":"Modified","description":"Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.\nThere are currently no workaround for older versions, and the recommendation is to upgrade.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-20"],"references":["https://github.com/cube-js/cube/releases/tag/v0.34.34","https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm","https://github.com/cube-js/cube/releases/tag/v0.34.34","https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm"],"products":["cube:cube.js"],"source":"nvd","synced_at":"2026-10-19T21:42:34.585441961+00:00"},"epss":{"cve":"CVE-2023-50709","score":0.00722,"percentile":0.54008,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9759-3276-g2pm","url":"https://osv.dev/vulnerability/GHSA-9759-3276-g2pm","summary":"Cube API denial of service attack","modified":"2023-12-19T20:39:57Z","packages":[{"ecosystem":"npm","name":"@cubejs-backend/api-gateway","purl":"pkg:npm/%40cubejs-backend/api-gateway","ranges":["<0.34.34"],"fixed":["0.34.34"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}