#VU86028 Resource management error in Apache Airflow - CVE-2023-36543

Vulnerability identifier: #VU86028

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-36543

CWE-ID: CWE-399

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache Airflow
Web applications / Modules and components for CMS

Vendor: Apache Foundation

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. A remote user can send specially crafted request to the application and make the current request hang, resulting in resource exhaustion leading to denial of service.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache Airflow: 0.1 - 2.6.2

---

External links
https://github.com/apache/airflow/pull/32060
https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.