Vulnerability Description
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openfga | Openfga | < 1.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vqThird Party Advisory
- https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vqThird Party Advisory
FAQ
What is CVE-2023-45810?
CVE-2023-45810 is a vulnerability with a CVSS score of 5.3 (MEDIUM). OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of ...
How severe is CVE-2023-45810?
CVE-2023-45810 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-45810?
Check the references section above for vendor advisories and patch information. Affected products include: Openfga Openfga.