GHSA-2vrg-7rqv-prf9

Source

https://github.com/advisories/GHSA-2vrg-7rqv-prf9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2vrg-7rqv-prf9/GHSA-2vrg-7rqv-prf9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2vrg-7rqv-prf9

Aliases

Published

2026-06-05T03:31:34Z

Modified

2026-07-23T15:11:43Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map

Details

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-404"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T23:37:50Z",
    "nvd_published_at": "2026-06-05T02:17:10Z",
    "severity": "LOW"
}

References

Affected packages

PyPI / infinistore

Package

Name: infinistore; View open source insights on deps.dev
Purl: pkg:pypi/infinistore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.2.33

Affected versions

0.*

0.1.72

0.1.73

0.1.74

0.1.82

0.1.89

0.1.90

0.1.91

0.1.96

0.1.98

0.1.99

0.1.100

0.1.101

0.1.115

0.1.128

0.1.129

0.1.136

0.1.137

0.1.152

0.2.7

0.2.8

0.2.11

0.2.22

0.2.32

0.2.33

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2vrg-7rqv-prf9/GHSA-2vrg-7rqv-prf9.json"