CVE-2024-23820 OpenFGA DoS

What is CVE-2024-23820?

CVE-2024-23820 is a medium-severity denial of service vulnerability in openfga, published on 26 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.

Weakness: CWE-401, CWE-770

Which versions are affected by CVE-2024-23820?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 1 product.

Products include Openfga Openfga.

How do I fix CVE-2024-23820?

Upgrade github.com/openfga/openfga to 1.4.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-23820 being exploited?

There is no known exploitation of CVE-2024-23820 in the wild and no public exploit code.

Other vulnerabilities in openfga

• CVE-2024-31452 OpenFGA Authorization Bypass High 8.1
• CVE-2022-23542 OpenFGA Authorization Bypass High 7.7
• CVE-2024-42473 OpenFGA Authorization Bypass High 7.5
• CVE-2026-40293 OpenFGA Playground Preshared Key Exposure Medium 6.5
• CVE-2023-40579 OpenFGA Authorization Bypass Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rxpw-85vw-fx87, GO-2024-2477.