Lucene search

K
osvGoogleOSV:GO-2023-2399
HistoryJan 03, 2024 - 10:56 p.m.

Denial of service via memory exhaustion in github.com/hashicorp/vault

2024-01-0322:56:19
Google
osv.dev
7
denial of service
memory exhaustion
unauthenticated requests
authenticated requests
http
memory mapping
large requests
host crashes
software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

Unauthenticated and authenticated HTTP requests from a client will be attempted to be mapped to memory. Large requests may result in the exhaustion of available memory on the host, which may cause crashes and denial of service.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%