-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability lies in the uncontrolled resource consumption when parsing JSON request bodies in OpenBao. An unauthenticated attacker could send a specially crafted JSON payload that, while small in size, would consume a large amount of memory when deserialized, leading to a Denial of Service. This is akin to a "zip bomb" but for JSON.
The analysis of the patches between the vulnerable version 2.4.0 and the patched version 2.4.1 reveals the exact functions involved. The initial fix in commit e06c48df5dc1da5617258cd0ef5cfdfc7de12b16 introduced a limit on the number of JSON tokens in the http.parseJSONRequest function. This was later refined in commit 21939c1c4b352e91725635085bb3fb4e4e42e9c0 to more accurately estimate memory usage and limit the number of strings by introducing a new function, http.NewSafeJSONReader.
The core of the vulnerability is in http.parseJSONRequest, which, prior to the patches, performed no validation on the complexity of the incoming JSON. The function http.LogicalRequest is the HTTP handler that calls parseJSONRequest for unauthenticated requests, making it the entry point for the attack. Therefore, both functions would likely appear in a runtime profile during exploitation. The function http.NewSafeJSONReader is the mitigation itself, containing the logic to prevent the excessive resource consumption.
http.parseJSONRequesthttp/handler.go
http.LogicalRequesthttp/logical.go
http.NewSafeJSONReaderhttp/json.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openbao/openbao | go | <= 2.4.0 | 2.4.1 |
Ongoing coverage of React2Shell