CVE-2024-8447CWE-833

CVE-2024-8447

Medium · published January 3, 2025

CVSS v3.1
5.9
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.8th percentile
Weakness
CWE-833 · Deadlock
Published
2025-01-03T02:15Z
References (6)
https://access.redhat.com/errata/RHSA-2025:3357 · [email protected]https://access.redhat.com/errata/RHSA-2025:3358 · [email protected]https://access.redhat.com/errata/RHSA-2025:7620 · [email protected]https://access.redhat.com/security/cve/CVE-2024-8447 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2335206 · [email protected]https://github.com/jbosstm/narayana/pull/2293 · [email protected]
EPSS history
Timeline
  • 02 JAN 20:19Z
    Narayana: deadlock via multiple join requests sent to lra coordinator
    cvelistv5