Allocation of Resources Without Limits or Throttling Affecting druid package, versions <31.0.0-r1
Threat Intelligence
EPSS
0.08% (34th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CHAINGUARDLATEST-DRUID-8352787
- published 7 Nov 2024
- disclosed 14 Oct 2024
Introduced: 14 Oct 2024
CVE-2024-8184 Open this link in a new tabHow to fix?
Upgrade Chainguard druid to version 31.0.0-r1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream druid package and not the druid package as distributed by Chainguard.
See How to fix? for Chainguard relevant fixed versions and status.
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Scores
version 3.1