Back to Database
Status published
Medium
CVE-2024-32886
Vitess vulnerable to infinite memory consumption and vtgate crash
Vulnerability Description
Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32886
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2
- https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df
- https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055
- https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d
- https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202
- https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79
- https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71
More from vitessio
View All →CVE-2024-53257
Vitess allows HTML injection in /debug/querylogz & /debug/env
Medium
4.9
CVE-2023-29195
Vitess VTAdmin users that can create shards can deny access to other functions
Medium
4.1
CVE-2023-29194
vitess allows users to create keyspaces that can deny access to already existing keyspaces
Medium
4.1
Affected Vendor
vitessio
View all reports →Affected Software
vitess
Vulnerable Versions:
< 17.0.7, >= 18.0.0, < 18.0.5, >= 19.0.0, < 19.0.4
Timeline
Official Publish:
May 8th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H