CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2024-23820
Medium (6.5) in openfga openfga. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/openfga/openfga 1.4.3.
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-401, CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openfga:openfga
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rxpw-85vw-fx87 | Go | github.com/openfga/openfga | <1.4.3 | 1.4.3 |
| GO-2024-2477 | Go | github.com/openfga/openfga | <1.4.3 | 1.4.3 |
References
- https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39
- https://github.com/openfga/openfga/releases/tag/v1.4.3
- https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87
- https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39
- https://github.com/openfga/openfga/releases/tag/v1.4.3