CWE-400

{
  "affected": [],
  "aliases": [
    "CVE-2024-6716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-15T15:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in libtiff. This flaw allows an attacker to create a crafted tiff file, forcing libtiff to allocate memory indefinitely. This issue can result in a denial of service of the system consuming libtiff due to memory starvation.",
  "id": "GHSA-h943-w3x2-738c",
  "modified": "2024-07-15T18:31:15Z",
  "published": "2024-07-15T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6716"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-6716"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297636"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/libtiff/libtiff/-/issues/620"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T23:15:21Z",
    "severity": "CRITICAL"
  },
  "details": "A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker may be able to cause unexpected app termination.",
  "id": "GHSA-h94m-mjfh-2g77",
  "modified": "2025-11-04T00:32:21Z",
  "published": "2025-04-01T00:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24247"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122373"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122374"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122375"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-06T19:25:24Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nA regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.6.0 or higher\n- Disable the `codesample` plugin\n- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting\n- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting\n\n### Acknowledgements\nTiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)",
  "id": "GHSA-h96f-fc7c-9r55",
  "modified": "2021-01-06T19:25:24Z",
  "published": "2021-01-06T19:25:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-h96f-fc7c-9r55"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/tinymce"
    },
    {
      "type": "WEB",
      "url": "https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Regex denial of service vulnerability in codesample plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-32816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-14T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced GHSL-2021-027.",
  "id": "GHSA-h97j-5ccr-wj2x",
  "modified": "2022-05-24T19:02:26Z",
  "published": "2022-05-24T19:02:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32816"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ProtonMail/WebClient/commit/6687fbb867ef872c96cf4fde68cb6e9c58d3fddc"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2021-027-redos-ProtonMail"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20491"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-13T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703556",
  "id": "GHSA-h97p-r383-p42m",
  "modified": "2022-12-15T18:30:25Z",
  "published": "2022-12-13T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20491"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2022-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-26307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-03T21:16:58Z",
    "severity": "HIGH"
  },
  "details": "Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.",
  "id": "GHSA-h9c5-x7g8-4q7f",
  "modified": "2026-07-09T18:31:28Z",
  "published": "2026-07-03T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/36809"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/36835"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitea.com/release-of-1.25.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-20T12:15:13Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: vlan: fix memory leak in __allowed_ingress\n\nWhen using per-vlan state, if vlan snooping and stats are disabled,\nuntagged or priority-tagged ingress frame will go to check pvid state.\nIf the port state is forwarding and the pvid state is not\nlearning/forwarding, untagged or priority-tagged frame will be dropped\nbut skb memory is not freed.\nShould free skb when __allowed_ingress returns false.",
  "id": "GHSA-h9h2-6w4q-6c52",
  "modified": "2024-07-03T18:46:09Z",
  "published": "2024-06-20T12:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48748"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/14be8d448fca6fe7b2a413831eedd55aef6c6511"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/446ff1fc37c74093e81db40811a07b5a19f1d797"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c5e216e880fa6f2cd9d4a6541269377657163098"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fd20d9738395cf8e27d0a17eba34169699fccdff"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-57080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T12:16:25Z",
    "severity": "HIGH"
  },
  "details": "Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix.\n\nThe peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the decoder waits until the buffer holds the full message before processing it, so the buffer grows without limit.\n\nPeer connections are unauthenticated, so any peer in the swarm exhausts the downloading process\u0027s memory. The largest legitimate message is a 16 KiB piece block, so any announced length far above that is anomalous.",
  "id": "GHSA-h9mr-rh28-v9r2",
  "modified": "2026-06-30T15:30:44Z",
  "published": "2026-06-30T12:31:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-7jr6-2jf4-6qc4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57080"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.8"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/platform-mesh/kubernetes-graphql-gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T15:05:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**CVSS 6.5 Medium** \u2014 The GraphQL API served by kubernetes-graphql-gateway is vulnerable to Denial-of-Service (DoS) attacks due to a complete absence of query resource controls (depth limiting, complexity analysis, response size capping, and rate limiting). An authenticated attacker can craft queries that force the server to compute and serialize multi-megabyte responses, consuming significant CPU, memory, and network bandwidth. Repeated requests can exhaust server resources and degrade or deny service to legitimate users.\n\n\u003e **Note:** A previous version of this advisory (based on pre-v1 code) documented an unauthenticated attack surface via an HTTP GET method bypass in the former `registry.go`. That bypass has been removed in v1 \u2014 all requests now require a Bearer token. The CVSS score has been adjusted from 7.5 to 6.5 accordingly (Privileges Required: None \u2192 Low). CWE-306 (Missing Authentication for Critical Function) no longer applies.\n\n## Root Cause\n\nThe kubernetes-graphql-gateway uses the `graphql-go/graphql` library (v0.8.1) with the `graphql-go/handler` HTTP handler. The handler is instantiated in `gateway/gateway/graphql/graphql.go` with only cosmetic configuration \u2014 no resource limits:\n\n```go\n// gateway/gateway/graphql/graphql.go \u2014 CreateHandler()\nfunc (s *GraphQLServer) CreateHandler(schema *graphql.Schema) *GraphQLHandler {\n    graphqlHandler := handler.New(\u0026handler.Config{\n        Schema:     schema,\n        Pretty:     s.config.Pretty,\n        Playground: s.config.Playground,\n        GraphiQL:   s.config.GraphiQL,\n    })\n    return \u0026GraphQLHandler{\n        Schema:  schema,\n        Handler: graphqlHandler,\n    }\n}\n```\n\nThe `handler.Config` struct does not include `MaxDepth`, `MaxComplexity`, `MaxResponseSize`, or any equivalent fields. Neither the `graphql-go/handler` nor the underlying `graphql-go/graphql` library provides built-in query depth or complexity analysis.\n\nThe application configuration (`gateway/gateway/config/config.go`) has no fields for resource limits:\n\n```go\n// gateway/gateway/config/config.go \u2014 GraphQL config\ntype GraphQL struct {\n    Pretty     bool\n    Playground bool\n    GraphiQL   bool\n}\n```\n\nNo rate limiting, throttling, or request size controls exist anywhere in the codebase.\n\n## Authentication Model\n\nAll requests pass through the HTTP handler in `gateway/http/http.go`, which extracts a Bearer token and injects it into the request context:\n\n```go\n// gateway/http/http.go \u2014 Token extraction (applied to all methods)\ns.Handle(\"/api/clusters/{clusterName}\", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n    clusterName := r.PathValue(\"clusterName\")\n    authHeader := r.Header.Get(\"Authorization\")\n    token := strings.TrimPrefix(authHeader, \"Bearer \")\n    ctx := utilscontext.SetToken(r.Context(), token)\n    ctx = utilscontext.SetCluster(ctx, clusterName)\n    c.Gateway.ServeHTTP(w, r.WithContext(ctx))\n}))\n```\n\nThe token is enforced at the Kubernetes API layer via `gateway/gateway/roundtripper/bearer.go`, which returns HTTP 401 for requests without a valid token. However, the GraphQL execution engine (query parsing, schema validation, introspection) still runs **before** the Kubernetes API is contacted \u2014 meaning authenticated users can trigger expensive operations that consume server resources without hitting the K8s API at all.\n\n## Attack Vectors\n\n### 1. Nested Introspection Field Expansion\n\nThe GraphQL schema contains 3,508 types (Kubernetes resources + platform CRDs). Introspection meta-fields (`__schema`, `__type`) allow recursive field expansion. Each additional nesting level multiplies the response size exponentially. A single full introspection query generates ~5.2 MB of response data in ~1.15s.\n\n### 2. Parallel Request Amplification\n\nWithout rate limiting, an authenticated attacker can issue many concurrent expensive queries. 5 parallel requests generate ~18.6 MB total response in under 4 seconds with no throttling. At scale (e.g. 999 concurrent requests), the backend becomes unresponsive and returns 503 to all users.\n\n### 3. Subscription Resource Exhaustion\n\nThe `HandleSubscription()` method in `gateway/gateway/graphql/graphql.go` processes SSE (Server-Sent Events) subscription requests. A malicious authenticated client can open many subscription channels simultaneously, holding server connections and memory indefinitely:\n\n```go\n// gateway/gateway/graphql/graphql.go \u2014 HandleSubscription()\nsubscriptionChannel := graphql.Subscribe(subscriptionParams)\nfor res := range subscriptionChannel {\n    // ... marshal and flush indefinitely ...\n}\n```\n\nThere is no limit on the number of concurrent subscriptions, no idle timeout, and no per-client connection cap.\n\n### 4. Deep Query Execution\n\nAuthenticated users can submit arbitrarily deep and complex GraphQL queries. The GraphQL execution engine processes the full query \u2014 consuming CPU and memory for schema validation, field resolution, and error/response formatting \u2014 before any Kubernetes API authorization is checked. The request handling in `gateway/gateway/endpoint/endpoint.go` passes directly to the handler with no query guards:\n\n```go\n// gateway/gateway/endpoint/endpoint.go \u2014 ServeHTTP()\nfunc (e *Endpoint) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n    if e.handler == nil || e.handler.Handler == nil {\n        http.Error(w, \"Endpoint not ready\", http.StatusServiceUnavailable)\n        return\n    }\n    if r.Header.Get(\"Accept\") == \"text/event-stream\" {\n        e.graphqlServer.HandleSubscription(w, r, e.handler.Schema)\n        return\n    }\n    e.handler.Handler.ServeHTTP(w, r)\n}\n```\n\n## Impact\n\n- **Availability (High):** Service denial achievable \u2014 concurrent expensive queries cause backend to become unresponsive (503 for all users). With 3,508 types and no depth limits, each introspection query generates a ~5.2 MB response. The absence of rate limiting, query complexity controls, and response size caps allows an authenticated attacker to exhaust server CPU, memory, and bandwidth.\n- **Confidentiality (None):** Information disclosure is covered in a separate finding.\n- **Integrity (None):** No data modification possible.\n\n## Affected Components\n\n- `gateway/gateway/graphql/graphql.go` \u2014 Handler creation with no resource limits; subscription handler with no connection limits\n- `gateway/gateway/endpoint/endpoint.go` \u2014 Direct passthrough to handler, no query depth/complexity middleware\n- `gateway/gateway/config/config.go` \u2014 No configuration fields for resource limits\n- `gateway/http/http.go` \u2014 No rate limiting middleware\n- `graphql-go/graphql` library \u2014 No built-in depth/complexity limiting\n- `graphql-go/handler` \u2014 No resource limit configuration options\n\n## Recommendations\n\n1. **Disable Introspection in Production** \u2014 As a defense-in-depth measure, disable introspection in non-development environments. This removes the highest-cost query path. If GraphiQL/Playground must remain accessible for development, gate it behind an environment flag.\n2. **Implement Query Depth and Complexity Limiting** \u2014 Implement middleware that parses the query AST and rejects queries exceeding configurable thresholds before execution. Recommended maximum depth: 10 levels. Assign cost values to fields and enforce a maximum query cost budget \u2014 introspection meta-fields (`__schema`, `__type`) should carry elevated costs. Alternatively, consider migrating to a GraphQL library with built-in depth/complexity support (e.g., `gqlgen` with its complexity extension, or `graph-gophers/graphql-go` with its `MaxDepth` option).\n3. **Implement Rate Limiting and Response Size Controls** \u2014 Add per-user rate limiting on the GraphQL endpoint. Suggested thresholds: 60 requests/minute for authenticated users, 2 requests/minute for introspection queries. Cap response payload size (e.g., 5 MB). For subscriptions, enforce maximum concurrent connections per client, idle timeouts, and maximum subscription duration.\n4. **Add Resource Limit Configuration** \u2014 Extend the `GraphQL` struct in `gateway/gateway/config/config.go` to expose all resource limits (max query depth, max complexity, max response size, rate limit thresholds) as configurable parameters. This ensures all protective thresholds can be tuned per environment without code changes.\n\n## References\n\n- [OWASP GraphQL Cheat Sheet \u2014 Resource Limits](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html)\n- [OWASP API4:2023 \u2014 Unrestricted Resource Consumption](https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/)\n- [CWE-770: Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html)\n- [CWE-400: Uncontrolled Resource Consumption](https://cwe.mitre.org/data/definitions/400.html)\n\n## Classification\n\n- **CWE-770** \u2014 Allocation of Resources Without Limits or Throttling\n- **CWE-400** \u2014 Uncontrolled Resource Consumption\n- **OWASP Top 10 2021:** A05:2021 \u2014 Security Misconfiguration\n- **OWASP API Security Top 10:** API4:2023 \u2014 Unrestricted Resource Consumption\n- **STRIDE:** Denial of Service (D)\n\n## Internal Reference\n\nHASI2026141-32 \u2014 Due: 2026-04-16",
  "id": "GHSA-h9mw-h4qc-f5jf",
  "modified": "2026-04-08T15:05:10Z",
  "published": "2026-04-08T15:05:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/platform-mesh/kubernetes-graphql-gateway/security/advisories/GHSA-h9mw-h4qc-f5jf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/platform-mesh/kubernetes-graphql-gateway/commit/61509656fbab2dbf158f634d6700478ee94221ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/platform-mesh/kubernetes-graphql-gateway"
    },
    {
      "type": "WEB",
      "url": "https://github.com/platform-mesh/kubernetes-graphql-gateway/releases/tag/v1.2.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-10T17:15:58Z",
    "severity": "HIGH"
  },
  "details": "A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in \u0027just me\u0027 mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the [validatedRequest] middleware with a specially crafted \u0027Authorization:\u0027 header. This vulnerability leads to uncontrolled resource consumption, causing a DoS condition.",
  "id": "GHSA-h9w4-3hv9-j8r3",
  "modified": "2024-04-10T18:30:49Z",
  "published": "2024-04-10T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3569"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mintplex-labs/anything-llm/commit/efe9dfa5e3550d12abd34d06ab7f8fbcf2206cfa"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/619e13bd-b723-4727-9ccb-5099d698432e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}