CVE-2023-45810

    Dashboard / Vulnerabilities / CVE-2023-45810

    CVE-2023-45810

    Published: 17 Oct 2023Last Modified: 28 Oct 2026

    Summary: OpenFGA denial of service

    Details: OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45810.json, https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq, https://nvd.nist.gov/vuln/detail/CVE-2023-45810

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9f60a57262bec4a5f45c1d24a3f0807872e29e28

    Affected versions

    v1.3.3
    v1.3.2
    v1.3.1
    v1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High