OpenFGA denial of service

中 6.5CVE-2024-23820 · GHSA-rxpw-85vw-fx87 · GO-2024-2477 · 26/01/2024 公開 · 17/06/2026 更新

要点

CVE-2024-23820 は github.com/openfga/openfga, openfga (openfga) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.4% より高い）。
対処：1.4.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/openfga/openfga Go	`< 1.4.3`	`1.4.3`
openfga openfga	`< 1.4.3`	`1.4.3`

概要

Overview

OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.

Fix

Upgrade to v1.4.3. This upgrade is backwards compatible.

NVD の説明

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.