CVE-2023-35933
OpenFGA denial of service die to circular relationship
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.1% · top 33% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/openfga/openfgaGHSA-hr9r-8phq-5x8j (opens in a new tab)
References (4)
- https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452 (opens in a new tab)x_refsource_MISCx_transferred
- https://openfga.dev/api/service#/Relationship%20Queries/Check (opens in a new tab)x_refsource_MISCx_transferred
- https://openfga.dev/api/service#/Relationship%20Queries/ListObjects (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hr9r-8phq-5x8j (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-35933)Record last updated .