CVE-2023-35933: openfga

csirt@kutim:~/threat-intel/cve/CVE-2023-35933

CVSS 7.5 · High EPSS 1,1%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada openfga. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

Rincian

Terbit di NVD: 26 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 65,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openfga	openfga	Semua versi sebelum 1.1.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j advisory vendor
https://openfga.dev/api/service#/Relationship%20Queries/Check exploit · advisory vendor
https://openfga.dev/api/service#/Relationship%20Queries/ListObjects exploit · advisory vendor
https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.