CVE-2024-23820

Summary

CVE-2024-23820 is a denial-of-service vulnerability affecting OpenFGA, an authorization/permission engine, prior to version 1.4.3. The issue arises when a call to `ListObjects` fails to properly release memory. When this situation occurs frequently, due to specific model and tuple combinations, the OpenFGA server can trigger an "out of memory" error and subsequently terminate. Version 1.4.3 includes a patch to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.