Low severity3.7OSV Advisory· Published May 14, 2024· Updated Apr 15, 2026

CVE-2024-34079

Description

octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/octo-sts/appGo	< 0.1.0	0.1.0

Affected products

Octo Sts/AppOSV
osv-coords5 versions
pkg:apk/chainguard/octo-sts pkg:apk/chainguard/octo-sts-webhook pkg:apk/wolfi/octo-sts pkg:apk/wolfi/octo-sts-webhook pkg:golang/github.com/octo-sts/app
< 0+ 4 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.1.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-75r6-6jg8-pfcqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34079ghsaADVISORY
github.com/octo-sts/app/commit/74ba874c017cf973edd6711144cf4399a9fcff57nvdWEB
github.com/octo-sts/app/security/advisories/GHSA-75r6-6jg8-pfcqnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000