High severity7.5OSV Advisory· Published May 7, 2024· Updated Apr 15, 2026
CVE-2024-34084
CVE-2024-34084
Description
Minder's HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an attacker with the ability to send requests to HandleGithubWebhook to crash the Minder controlplane and deny other users from using it. This vulnerability is fixed in 0.0.48.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/stacklok/minderGo | < 0.0.48 | 0.0.48 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-9c5w-9q3f-3hv7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-34084ghsaADVISORY
- github.com/stacklok/minder/blob/ee66f6c0763212503c898cfefb65ce1450c7f5ac/internal/controlplane/handlers_githubwebhooks.goghsaWEB
- github.com/stacklok/minder/blob/ee66f6c0763212503c898cfefb65ce1450c7f5ac/internal/controlplane/handlers_githubwebhooks.goghsaWEB
- github.com/stacklok/minder/blob/ee66f6c0763212503c898cfefb65ce1450c7f5ac/internal/controlplane/handlers_githubwebhooks.goghsaWEB
- github.com/stacklok/minder/blob/ee66f6c0763212503c898cfefb65ce1450c7f5ac/internal/controlplane/handlers_githubwebhooks_test.goghsaWEB
- github.com/stacklok/minder/commit/3e5a527d2f1b535159206161d1d519602c75bd0dnvdWEB
- github.com/stacklok/minder/security/advisories/GHSA-9c5w-9q3f-3hv7nvdWEB
News mentions
0No linked articles in our index yet.