PT-2024-25689 · Octo-Sts · Octo-Sts

Enj · Published 2024-05-10 · Updated 2025-11-26 · CVE-2024-34079

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions octo-sts versions prior to 0.1.0

Description The issue can cause a spike in resource utilization of the STS service. When combined with significant traffic volume, it could potentially lead to a denial of service. Excessively large requests can be processed, consuming a large amount of resources.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 to resolve the issue. As a temporary workaround, consider restricting the size of requests processed by the STS service to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-34079

GHSA-75R6-6JG8-PFCQ

GO-2024-2833

Affected Products

Octo-Sts

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34079.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-34079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34079 · Security Note
• https://osv.dev/vulnerability/GHSA-75r6-6jg8-pfcq · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2833 · Vendor Advisory
• https://github.com/octo-sts/app · Note
• https://github.com/octo-sts/app/commit/74ba874c017cf973edd6711144cf4399a9fcff57 · Note
• https://github.com/octo-sts/app/security/advisories/GHSA-75r6-6jg8-pfcq · Note
• https://twitter.com/dailycve/status/1993474258522325037 · Twitter Post
• https://twitter.com/oktsec/status/1809666004995158514 · Twitter Post