CVE-2023-38976 Weaviate denial of service vulnerability

What is CVE-2023-38976?

CVE-2023-38976 is a high-severity denial of service vulnerability in n/a, published on 21 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.

Weakness: CWE-617

Which versions are affected by CVE-2023-38976?

7 open source packages ship an affected version, including github.com/weaviate/weaviate. It affects 1 product.

Products include Weaviate Weaviate.

How do I fix CVE-2023-38976?

Upgrade github.com/weaviate/weaviate to a fixed version for your release line: 1.18.6, 1.19.13 or 1.20.6.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-38976 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38976 exists.

Other vulnerabilities in n/a

• CVE-2026-59093 Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment High 8.7
• CVE-2025-67818 Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip High 7.2
• CVE-2025-67819 Weaviate OSS has path traversal vulnerability via the Shard Movement API Medium 4.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8697-479h-5mfp, GO-2023-2017.