CVE-2023-35933CWE-835

OpenFGA denial of service die to circular relationship

Medium · published June 26, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01133 · 66.2th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2023-06-26T19:26Z
EPSS history
Timeline
  • 26 JUN 19:26Z
    OpenFGA denial of service die to circular relationship
    cvelistv5