CVE-2024-12289

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12289
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12289.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12289
Aliases
Downstream
Related
Published
2024-12-12T22:42:01.595Z
Modified
2026-07-15T01:48:52.153644722Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Details

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.

This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12289.json",
    "cwe_ids": [
        "CWE-460"
    ],
    "cna_assigner": "HashiCorp"
}
References

Affected packages

Git / github.com/hashicorp/boundary

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/boundary
Events
Introduced
bc86b4e9e9adfdf07183cbf140a2802fb453b35f
Fixed
36595c59c9662f8531ec192e6b84aee5024687c9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.8.0"
        },
        {
            "fixed": "0.18.2"
        },
        {
            "introduced": "0.18.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:hashicorp:boundary:*:*:*:*:*:*:*:*"
}

Affected versions

api/v0.*
api/v0.0.25
api/v0.0.26
api/v0.0.27
api/v0.0.28
api/v0.0.29
api/v0.0.33
api/v0.0.35
api/v0.0.36
api/v0.0.37
api/v0.0.38
api/v0.0.39
api/v0.0.40
api/v0.0.41
api/v0.0.43
api/v0.0.44
api/v0.0.45
api/v0.0.50
api/v0.0.52
api/v0.0.53
sdk/v0.*
sdk/v0.0.16
sdk/v0.0.17
sdk/v0.0.18
sdk/v0.0.19
sdk/v0.0.20
sdk/v0.0.21
sdk/v0.0.22
sdk/v0.0.24
sdk/v0.0.27
sdk/v0.0.28
sdk/v0.0.29
sdk/v0.0.31
sdk/v0.0.32
sdk/v0.0.33
sdk/v0.0.34
sdk/v0.0.35
sdk/v0.0.36
sdk/v0.0.37
sdk/v0.0.39
sdk/v0.0.40
sdk/v0.0.41
sdk/v0.0.42
sdk/v0.0.48
sdk/v0.0.49
v0.*
v0.10.0
v0.13.0
v0.15.0
v0.17.0
v0.18.0
v0.18.1
v0.8.0
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12289.json"