CVE-2024-56200 Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy
Attackers can cause denial of service by exploiting unvalidated image proxy requests to exhaust server CPU and network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-56200?
CVE-2024-56200 is a high-severity denial of service vulnerability in nexryai altair, published on 19 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-56200?
How do I fix CVE-2024-56200?
No fix has been published for CVE-2024-56200 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-56200 being exploited?
There is no known exploitation of CVE-2024-56200 in the wild and no public exploit code.