CVE-2024-57439 RuoYi vulnerable to Denial of Service by attackers with admin privileges

What is CVE-2024-57439?

CVE-2024-57439 is a medium-severity denial of service vulnerability in Ruoyi Ruoyi, published on 29 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.

Weakness: CWE-281

Which versions are affected by CVE-2024-57439?

2 open source packages ship an affected version, including com.ruoyi:ruoyi. It affects 1 product.

Products include Ruoyi Ruoyi.

How do I fix CVE-2024-57439?

No fix has been published for CVE-2024-57439 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-57439 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-57439 exists.

Other vulnerabilities in Ruoyi Ruoyi

• CVE-2024-57521 SQL injection in n/a Critical 10.0
• CVE-2025-28402 Privilege escalation in n/a Critical 9.8
• CVE-2025-28405 Privilege escalation in n/a Critical 9.8
• CVE-2025-28406 Privilege escalation in n/a Critical 9.8
• CVE-2025-28408 Missing authorization in n/a Critical 9.8

All Ruoyi Ruoyi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qq5h-rjj9-q9qg.