Medium severity · published Jul 23, 2024
CVE-2024-39702
In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks
5.9
CVSS
0.6%
EPSS
No
On KEV
Description
In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in the openresty/luajit2 GitHub repository. The LuaJIT/LuaJIT repository. is unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openresty · Openresty
1.19.3.1 before 1.19.9.2; 1.21.4.1 before 1.21.4.4; 1.25.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39702
Patch
https://openresty.org/en/ann-1025003002.html
More from Openresty
9.8
CVE-2018-9230
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one,…
7.7
CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…
7.5
CVE-2026-55233
OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
7.5
CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4