CVE-2024-23820

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.

• CWE-770
• CWE-401

• https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39Patch
• https://github.com/openfga/openfga/releases/tag/v1.4.3Release Notes
• https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87Third Party Advisory
• https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39Patch
• https://github.com/openfga/openfga/releases/tag/v1.4.3Release Notes
• https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87Third Party Advisory

Published

Jan 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23815A vulnerability has been identified in Desigo CC (All versio…8.7
• CVE-2024-23816A vulnerability has been identified in Location Intelligence…9.8
• CVE-2024-23817Dolibarr is an enterprise resource planning (ERP) and custom…6.1
• CVE-2024-23818GeoServer is an open source software server written in Java …4.8
• CVE-2024-23819GeoServer is an open source software server written in Java …4.8
• CVE-2024-2382The Authorize.net Payment Gateway For WooCommerce plugin for…5.3
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23822Thruk is a multibackend monitoring webinterface. Prior to 3…9.8
• CVE-2024-23823vantage6 is an open source framework built to enable, manage…6.5
• CVE-2024-23824mailcow is a dockerized email package, with multiple contain…2.7
• CVE-2024-23825TablePress is a table plugin for Wordpress. For importing ta…4.9
• CVE-2024-23826spbu_se_site is the website of the Department of System Prog…5.7