GHSA-mv64-86g8-cqq7

Suggest an improvement
Source
https://github.com/advisories/GHSA-mv64-86g8-cqq7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-mv64-86g8-cqq7/GHSA-mv64-86g8-cqq7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mv64-86g8-cqq7
Aliases
  • CVE-2024-1726
Published
2024-04-25T18:30:39Z
Modified
2024-04-25T23:56:50.611572Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Quarkus: security checks in resteasy reactive may trigger a denial of service
Details

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Database specific 
{
    "nvd_published_at": "2024-04-25T17:15:48Z",
    "cwe_ids": [
        "CWE-281"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T23:34:44Z"
}
References

Affected packages

Maven / io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.8.0.CR1
Fixed
3.8.0

Affected versions

3.*

3.8.0.CR1

Maven / io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3.0.CR1
Fixed
3.7.4

Affected versions

3.*

3.3.0.CR1
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0.CR1
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0.CR1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0.CR1
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.7.0.CR1
3.7.0
3.7.1
3.7.2
3.7.3

Maven / io.quarkus.resteasy.reactive:resteasy-reactive

Package

Name
io.quarkus.resteasy.reactive:resteasy-reactive
View open source insights on deps.dev
Purl
pkg:maven/io.quarkus.resteasy.reactive/resteasy-reactive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.11.Final

Affected versions

1.*

1.11.0.Beta1
1.11.0.Beta2
1.11.0.CR1
1.11.0.Final
1.11.1.Final
1.11.2.Final
1.11.3.Final
1.11.4.Final
1.11.5.Final
1.11.6.Final
1.11.7.Final
1.12.0.CR1
1.12.0.Final
1.12.1.Final
1.12.2.Final
1.13.0.CR1
1.13.0.Final
1.13.1.Final
1.13.2.Final
1.13.3.Final
1.13.4.Final
1.13.5.Final
1.13.6.Final
1.13.7.Final

2.*

2.0.0.Alpha1
2.0.0.Alpha2
2.0.0.Alpha3
2.0.0.CR1
2.0.0.CR2
2.0.0.CR3
2.0.0.Final
2.0.1.Final
2.0.2.Final
2.0.3.Final
2.1.0.CR1
2.1.0.Final
2.1.1.Final
2.1.2.Final
2.1.3.Final
2.1.4.Final
2.2.0.CR1
2.2.0.Final
2.2.1.Final
2.2.2.Final
2.2.3.Final
2.2.4.Final
2.2.5.Final
2.3.0.CR1
2.3.0.Final
2.3.1.Final
2.4.0.CR1
2.4.0.Final
2.4.1.Final
2.4.2.Final
2.5.0.CR1
2.5.0.Final
2.5.1.Final
2.5.2.Final
2.5.3.Final
2.5.4.Final
2.6.0.CR1
2.6.0.Final
2.6.1.Final
2.6.2.Final
2.6.3.Final
2.7.0.CR1
2.7.0.Final
2.7.1.Final
2.7.2.Final
2.7.3.Final
2.7.4.Final
2.7.5.Final
2.7.6.Final
2.7.7.Final
2.8.0.CR1
2.8.0.Final
2.8.1.Final
2.8.2.Final
2.8.3.Final
2.9.0.CR1
2.9.0.Final
2.9.1.Final
2.9.2.Final
2.10.0.CR1
2.10.0.Final
2.10.1.Final
2.10.2.Final
2.10.3.Final
2.10.4.Final
2.11.0.CR1
2.11.0.Final
2.11.1.Final
2.11.2.Final
2.11.3.Final
2.12.0.CR1
2.12.0.Final
2.12.1.Final
2.12.2.Final
2.12.3.Final
2.13.0.CR1
2.13.0.Final
2.13.1.Final
2.13.2.Final
2.13.3.Final
2.13.4.Final
2.13.5.Final
2.13.6.Final
2.13.7.Final
2.13.8.Final
2.13.9.Final
2.14.0.CR1
2.14.0.Final
2.14.1.Final
2.14.2.Final
2.14.3.Final
2.15.0.CR1
2.15.0.Final
2.15.1.Final
2.15.2.Final
2.15.3.Final
2.16.0.CR1
2.16.0.Final
2.16.1.Final
2.16.2.Final
2.16.3.Final
2.16.4.Final
2.16.5.Final
2.16.6.Final
2.16.7.Final
2.16.8.Final
2.16.9.Final
2.16.10.Final
2.16.11.Final
2.16.12.Final

3.*

3.0.0.Alpha1
3.0.0.Alpha2
3.0.0.Alpha3
3.0.0.Alpha4
3.0.0.Alpha5
3.0.0.Alpha6
3.0.0.Beta1
3.0.0.CR1
3.0.0.CR2
3.0.0.Final
3.0.1.Final
3.0.2.Final
3.0.3.Final
3.0.4.Final
3.1.0.CR1
3.1.0.Final
3.1.1.Final
3.1.2.Final
3.1.3.Final
3.2.0.CR1
3.2.0.Final
3.2.1.Final
3.2.2.Final
3.2.3.Final
3.2.4.Final
3.2.5.Final
3.2.6.Final
3.2.7.Final
3.2.8.Final
3.2.9.Final
3.2.10.Final