medium6.5
CVE-2023-50709
Cube API denial of service attack
Impact
### Impact It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. ### Patches The issue has been patched in the `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. ### Workarounds There are currently no workaround for older versions, and the recommendation is to upgrade. ### References The issue was reported by [y0d3n](https://github.com/y0d3n) in our Community Slack and has been promptly patched in the recent update.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @cubejs-backend/api-gateway | < 0.34.34 | 0.34.34 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cube | Cube.Js | before 0.34.34 |