CVE-2024-23820

    Dashboard / Vulnerabilities / CVE-2024-23820

    CVE-2024-23820

    Published: 26 Jan 2024Last Modified: 12 Aug 2026

    Summary: OpenFGA DoS

    Details: OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.

    References: https://github.com/openfga/openfga/releases/tag/v1.4.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23820.json, https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87, https://nvd.nist.gov/vuln/detail/CVE-2024-23820, https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -59527d9d5cf8561470ec88a30a9395c6ab2d4e57

    Affected versions

    v1.4.1
    v1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23820 | CVE-DB