Klausvii

**Name of the Vulnerable Software and Affected Versions** OpenFGA versions prior to 1.3.4 **Description** OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. **Recommendations** Upgrade to version 1.3.4, as this upgrade is backwards compatible and addresses the issue. There are no known workarounds for this vulnerability.