CVE-2023-45810 - CVE House
Back to Database
Status published Medium CVE-2023-45810

OpenFGA denial of service

Vulnerability Description

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45810

Credits & Attribution

No credits recorded in the NVD database.

References

More from openfga

View All →
CVE-2025-64751
OpenFGA Improper Policy Enforcement
Medium 5.8
CVE-2025-55213
OpenFGA Authorization Bypass (Check)
Medium 5.8
CVE-2025-48371
OpenFGA Authorization Bypass
Medium 5.8
CVE-2025-46331
OpenFGA Authorization Bypass
Medium 5.8
CVE-2025-25196
OpenFGA Authorization Bypass
Medium 5.8

Affected Vendor

Affected Software

openfga
Vulnerable Versions:
< 1.3.4

Timeline

Official Publish: October 17th, 2023
Last Modified: September 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact