CVE-2023-50709 Denial of service attack on the cube-api endpoint

What is CVE-2023-50709?

CVE-2023-50709 is a medium-severity denial of service vulnerability in cube-js cube, published on 13 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the recommendation is to upgrade.

Weakness: CWE-20

Which versions are affected by CVE-2023-50709?

2 open source packages ship an affected version, including @cubejs-backend/api-gateway. It affects 1 product.

Products include Cube Cube.js.

How do I fix CVE-2023-50709?

Upgrade @cubejs-backend/api-gateway to 0.34.34 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-50709 being exploited?

There is no known exploitation of CVE-2023-50709 in the wild and no public exploit code.

Other vulnerabilities in cube-js cube

• CVE-2022-23510 SQl injection in cube-js Critical 9.6
• CVE-2026-25958 Cube privilege escalation via a specially crafted request High 7.7
• CVE-2026-25957 Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9759-3276-g2pm.