CVE-2024-31209 json
OpenID Connect client Atom Exhaustion in provider configuration worker ets table location
published 2024-04-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-1249 , GHSA-mj35-2rgf-cv8p
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
Patch / fix
- hex oidcc 3.0.2, 3.1.2, 3.2.0-beta.3
- erlef oidcc 3.0.2, 3.1.2, 3.2.0-beta.3
- github.com/erlef/oidcc@2f304d8 commit
- github.com/erlef/oidcc@48171fb commit
- github.com/erlef/oidcc@ac458ed commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | oidcc | >=3.0.0, <3.0.2 >=3.1.0, <3.1.2 >=3.2.0-beta.1, <3.2.0-beta.3 |
3.0.2 3.1.2 3.2.0-beta.3 |
Affected products
- erlef oidcc
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c
web
-
github.com
/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649
web
-
github.com
/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a
web
-
github.com
/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p
web
-
github.com
/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L3
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-31209
advisory
-
erlef.github.io
/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html
web
-
github.com
/erlef/oidcc
package
Sources
- CVE List CVE-2024-31209
- GitHub Advisory GHSA-mj35-2rgf-cv8p
- NVD CVE-2024-31209
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.