CVE-2023-27483

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the Paved.SetValue method sets a value on the Paved object according to the provided path, without any validation. This allows setting values in slices at any provided index, which grows the target array up to the requested index, the index is currently capped at max uint32 (4294967295) given how indexes are parsed, but that is still an unnecessarily large value. If callers are not validating paths' indexes on their own, which most probably are not going to do, given that the input is parsed directly in the SetValue method, this could allow users to consume arbitrary amounts of memory. Applications that do not use the `Paved` type's `SetValue` method are not affected. This issue has been addressed in versions 0.16.1 and 0.19.2. Users are advised to upgrade. Users unable to upgrade can parse and validate the path before passing it to the `SetValue` method of the `Paved` type, constraining the index size as deemed appropriate.

• CWE-20
• CWE-400
• CWE-400

• https://github.com/crossplane/crossplane-runtime/commit/53508a9f4374604db140dd8ab2fa52276441e738Patch
• https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-vfvj-3m3g-m532Vendor Advisory
• https://github.com/crossplane/crossplane-runtime/commit/53508a9f4374604db140dd8ab2fa52276441e738Patch
• https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-vfvj-3m3g-m532Vendor Advisory

Published

Mar 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27477wasmtime is a fast and secure runtime for WebAssembly. Wasmt…4.3
• CVE-2023-27478libmemcached-awesome is an open source C/C++ client library …6.5
• CVE-2023-27479XWiki Platform is a generic wiki platform offering runtime s…9.9
• CVE-2023-27480XWiki Platform is a generic wiki platform offering runtime s…7.7
• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27484crossplane-runtime is a set of go libraries used to build Ku…4.9
• CVE-2023-27485thmmniii/fbs-core is an open source feedback system for stud…4.3
• CVE-2023-27486xCAT is a toolkit for deployment and administration of compu…8.8
• CVE-2023-27487Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27488Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-27489Kiwi TCMS is an open source test management system for both …5.4