Denial of Service Vulnerability in lua-http Package: Excessive Allocation Risk
Summary
CVE-2023-4540: Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the serve... Affects lua-http versions < ddab2835c583d45dec62680ca8d3cbde55e0bae6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lua-http library is a widely used HTTP client and server implementation in Lua, designed for ease of use and flexibility. It allows developers to create robust web applications and services. However, the library is susceptible to a specific vulnerability that can lead to denial of service (DoS) attacks, impacting the availability of applications relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2023-4540, arises from improper handling of exceptional conditions within the lua-http library. This flaw allows an attacker to send a specially crafted request to the server, resulting in excessive memory allocation. If exploited, this can lead to a denial of service, rendering the affected application unresponsive. The issue affects all versions of lua-http prior to commit ddab283.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting on your server to mitigate the impact of potential DoS attacks. This can help control the number of requests processed by the server, reducing the likelihood of excessive allocation issues.
Conclusion
The CVE-2023-4540 vulnerability in the lua-http library poses a significant risk of denial of service due to excessive memory allocation. It is crucial for users to update their libraries to the latest version to safeguard their applications. Additionally, implementing workarounds can help mitigate potential impacts until an update can be applied.
See every vulnerability recorded for lua-http →
FAQ
CVE-2023-4540 is a vulnerability in the lua-http library that allows for excessive memory allocation, potentially leading to a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, making applications unresponsive and unavailable to users.
Yes, a patch is available in the latest version of the lua-http library, which can be installed to mitigate the vulnerability.
The CVSS score for CVE-2023-4540 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for lua-http.
