GHSA-ggmv-j932-q89q

Source

https://github.com/advisories/GHSA-ggmv-j932-q89q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-ggmv-j932-q89q/GHSA-ggmv-j932-q89q.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-ggmv-j932-q89q

Aliases

CVE-2025-53634

Published

2025-07-10T17:58:48Z

Modified

2025-07-10T23:22:14Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout

Details

Impact

The HTTP Gateway processes headers, but with no timeout set. With a Slowloris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.

Patches

Patch has been implemented by commit 1385bd8 and shipped in v0.1.4.

Workarounds

No workaround exist.

References

N/A

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-07-10T20:15:27Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed_at": "2025-07-10T17:58:48Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/ctfer-io/chall-manager

Package

Name: github.com/ctfer-io/chall-manager; View open source insights on deps.dev
Purl: pkg:golang/github.com/ctfer-io/chall-manager

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.1.4