CVE-2023-50248 - CVE House
Back to Database
Status published Medium CVE-2023-50248

CKAN out of memory error when submitting the dataset form with a specially-crafted field

Vulnerability Description

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-50248

Credits & Attribution

No credits recorded in the NVD database.

References

More from ckan

View All →
CVE-2025-64100
CKAN Vulnerable to Session Cookie Fixation
Medium 6.1
CVE-2025-54384
CKAN stored XSS vulnerability in Markdown description fields
Medium 6.3
CVE-2025-24372
XSS vector in user uploaded images in group/org and user profiles in ckan
High 7.3
CVE-2024-43371
Potential access to sensitive URLs via CKAN extensions (SSRF)
Medium 4.5
CVE-2024-41675
CKAN has a Cross-site Scripting vector in the Datatables view plugin
Medium 6.8

Affected Vendor

Affected Software

ckan
Vulnerable Versions:
>= 2.0.0, < 2.9.10, >= 2.10.0, < 2.10.3

Timeline

Official Publish: December 13th, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-130

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.