{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42481 exists.","fix":"No fix has been published for CVE-2024-42481 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-42481 is a high-severity denial of service vulnerability in skyportlabs skyportd, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-42481 and fix it if it is affected.\n\nWhat it is: CVE-2024-42481 is a high-severity denial of service vulnerability in skyportlabs skyportd, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42481 exists.\n\nAffected product: skyportlabs skyportd. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-42481/ (Markdown: https://insights.sbomify.com/CVE-2024-42481/index.md)","id":"CVE-2024-42481","markdown":"https://insights.sbomify.com/CVE-2024-42481/index.md","name":"CVE-2024-42481","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Skyport Panel daemon","requires_auth":"none","summary":"Attackers can crash the host system by creating excessive files and folders, causing resource exhaustion in the Skyport Daemon.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"skyportd","vendor":"skyport"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Skyport Daemon (skyportd) is the daemon for the Skyport Panel. By making thousands of folders \u0026 files (easy due to skyport's lack of rate limiting on createFolder. createFile), skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":null,"headline":"Complete crash of host system due to calculateDirectorySize in skyportd","id":"CVE-2024-42481","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":0,"n_references":1,"next":{"headline":"fish-shop/syntax-check Improper Neutralization of Delimiters","id":"CVE-2024-42482"},"packages":[],"prev":{"headline":"Kamaji's RBAC Roles for `etcd` are not disjunct","id":"CVE-2024-42480"},"products":["skyportd"],"published":"2024-08-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-13","vendors":["skyportlabs"]},"summary":"Attackers can crash the host system by creating excessive files and folders, causing resource exhaustion in the Skyport Daemon.","url":"https://insights.sbomify.com/CVE-2024-42481/"}