-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated use of the 'days' parameter in HTTP request handling. The PoC shows that a large 'days' value triggers OOM crashes, indicating the parameter is used to allocate memory (e.g., slice creation for date ranges). In Go web servers, query parameters are typically processed in HTTP handler functions. The lack of bounds checking before slice allocation aligns with CWE-770 and CWE-789. While the exact function name/path isn't explicitly provided in the advisory, the described behavior strongly points to the dashboard request handler as the vulnerable component.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/contribsys/faktory | go | < 1.8.0 | 1.8.0 |