CVE-2023-45810 OpenFGA denial of service

What is CVE-2023-45810?

CVE-2023-45810 is a medium-severity denial of service vulnerability in openfga, published on 17 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

Weakness: CWE-400

Which versions are affected by CVE-2023-45810?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 1 product.

Products include Openfga Openfga.

How do I fix CVE-2023-45810?

Upgrade github.com/openfga/openfga to 1.3.4 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-45810 being exploited?

There is no known exploitation of CVE-2023-45810 in the wild and no public exploit code.

Other vulnerabilities in openfga

• CVE-2024-31452 OpenFGA Authorization Bypass High 8.1
• CVE-2022-23542 OpenFGA Authorization Bypass High 7.7
• CVE-2024-42473 OpenFGA Authorization Bypass High 7.5
• CVE-2026-40293 OpenFGA Playground Preshared Key Exposure Medium 6.5
• CVE-2023-40579 OpenFGA Authorization Bypass Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hr4f-6jh8-f2vq, GO-2023-2121.