CVE-2024-32886

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32886
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-32886.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-32886
Aliases
Downstream
Published
2024-05-08T14:10:24.863Z
Modified
2026-05-18T12:03:00.319843337Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Vitess vulnerable to infinite memory consumption and vtgate crash
Details

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

Database specific 
{
    "cwe_ids": [
        "CWE-835"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32886.json"
}
References

Affected packages

Git / github.com/vitessio/vitess

Affected ranges

Type
GIT
Repo
https://github.com/vitessio/vitess
Events
Introduced
97fdf78e0f916df2a1404f78208307c9a8de78e1
Fixed
2c56724549a0fe9262a10ea5e8ffad8594d51a29

Affected versions

v0.*
v0.19.0
v0.19.1
v0.19.3
v19.*
v19.0.0
v19.0.1
v19.0.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-32886.json"