CVE-2024-39702
Medium
Description
In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in the openresty/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Openresty
PublishedJul 23, 2024
First seenJul 23, 2024
Weakness typeCWE-407CWE-407
How to fix
Update
- openresty openresty1.19.9.2, 1.21.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openresty openresty | 1.19.3.1 ≤ v < 1.19.9.2, 1.21.4.1 ≤ v < 1.21.4.4, 1.25.3.1 | 1.19.9.2, 1.21.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.