CVE-2023-31669 Denial of service in n/a

Medium 5.5 Published 23 May 2023 Updated 31 Jan 2025

Attackers can cause a crash in the wat2wasm tool by using specific input characters, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-31669?

CVE-2023-31669 is a medium-severity denial of service vulnerability in n/a, published on 23 May 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").

Weakness: CWE-116

Which versions are affected by CVE-2023-31669?

It affects 1 product.

Products include Webassembly Webassembly Binary Toolkit.

How do I fix CVE-2023-31669?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-31669 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31669 exists.

Sources

Also known as DEBIAN-CVE-2023-31669, GHSA-24pv-x5f7-pv4r, UBUNTU-CVE-2023-31669.