CVE-2023-26513 Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS
Attackers can cause denial of service in applications using Apache Sling Resource Merger by triggering excessive iteration on specific paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26513?
CVE-2023-26513 is a high-severity denial of service vulnerability in Apache Sling Resource Merger, published on 20 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.
Weakness: CWE-834
Which versions are affected by CVE-2023-26513?
2 open source packages ship an affected version, including org.apache.sling:org.apache.sling.resourcemerger. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sling:org.apache.sling.resourcemerger Maven | From 1.2.0 | 1.4.2 |
org.apache.sling:org.apache.sling.resourcemerger Maven | From 1.2.0 | 1.4.2 |
Products include Apache Sling Resource Merger.
How do I fix CVE-2023-26513?
Upgrade org.apache.sling:org.apache.sling.resourcemerger to 1.4.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26513 being exploited?
There is no known exploitation of CVE-2023-26513 in the wild and no public exploit code.
Sources
Also known as GHSA-rwrx-x2hw-9h5w.