CVE-2023-45810
Description
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
How to fix
- openfga openfga1.3.4 or later
- github.com/openfga/openfga1.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openfga openfga | v < 1.3.4 | 1.3.4 |
| github.com/openfga/openfgaGo | v < 1.3.4 | 1.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.