CVE-2024-32886 Vitess vulnerable to infinite memory consumption and vtgate crash
Attackers can cause vtgate to crash via infinite memory consumption using a specific query, impacting database availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32886?
CVE-2024-32886 is a medium-severity denial of service vulnerability in vitessio vitess, published on 8 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
Weakness: CWE-835
Which versions are affected by CVE-2024-32886?
13 open source packages ship an affected version, including github.com/vitessio/vitess and vitess.io/vitess.
| Package | Affected | Fixed in |
|---|---|---|
github.com/vitessio/vitess Go | All versions | 17.0.7 |
github.com/vitessio/vitess Go | All versions | 17.0.7 |
github.com/vitessio/vitess Go | From 18.0.0 | 18.0.5 |
github.com/vitessio/vitess Go | From 18.0.0 | 18.0.5 |
github.com/vitessio/vitess Go | From 19.0.0 | 19.0.4 |
github.com/vitessio/vitess Go | From 19.0.0 | 19.0.4 |
7 more packages
vitess.io/vitess Go | All versions | 0.17.7, 0.18.5, 0.19.4 |
vitess.io/vitess Go | All versions | 0.17.7 |
vitess.io/vitess Go | All versions | 0.17.7 |
vitess.io/vitess Go | From 0.18.0 | 0.18.5 |
vitess.io/vitess Go | From 0.18.0 | 0.18.5 |
vitess.io/vitess Go | From 0.19.0 | 0.19.4 |
vitess.io/vitess Go | From 0.19.0 | 0.19.4 |
How do I fix CVE-2024-32886?
Upgrade github.com/vitessio/vitess to a fixed version for your release line: 17.0.7, 18.0.5 or 19.0.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-32886 being exploited?
There is no known exploitation of CVE-2024-32886 in the wild and no public exploit code.
Sources
Also known as AZL-40360, AZL-40493, GHSA-649x-hxfx-57j2, GO-2024-2826.