CVE-2024-23820: openfga

Vulnerability summary

CVE-2024-23820 is a medium (CVSS 6.5) vulnerability in openfga. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.

Timeline

1. 26-01-2024
   PublishedVulnerability first disclosed.
2. 29-08-2024
   Last modifiedVulnerability information updated.

Description

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.