OpenFGA DoS vulnerability

CAO 7.5CVE-2023-45810 · GHSA-hr4f-6jh8-f2vq · GO-2023-2121 · Công bố 17/10/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-45810 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/openfga/openfga, openfga (openfga).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.61%, cao hơn 49.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.3.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/openfga/openfga Go	`< 1.3.4`	`1.3.4`
openfga openfga	`< 1.3.4`	`1.3.4`

Mô tả

Overview

OpenFGA is vulnerable to a DoS attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and the service as a whole becomes unresponsive.

Fix

Upgrade to v1.3.4. This upgrade is backwards compatible.

Mô tả của NVD

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.