PT-2024-28641 · Openresty · Openresty

Zhongwei Yao · Published 2024-07-23 · Updated 2025-09-24 · CVE-2024-39702

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenResty versions 1.19.3.1 through 1.25.3.1

Description The string hashing function in OpenResty allows HashDoS (Hash Denial of Service) attacks, which can cause excessive resource usage during proxy operations via crafted requests. This can potentially lead to a denial of service with relatively few incoming requests. The issue exists in the OpenResty fork in the openresty/luajit2 GitHub repository, but the LuaJIT/LuaJIT repository is unaffected.

Recommendations For OpenResty versions 1.19.3.1 through 1.25.3.1, consider disabling the string hashing function used during string interning as a temporary workaround until a patch is available. Restrict access to proxy operations to minimize the risk of exploitation. Avoid using crafted requests that could trigger the HashDoS attack.

Fix

DoS

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2024-39702

Affected Products

Openresty

References · 8

• https://openresty.org/en/ann-1025003002.html · Patch
• https://osv.dev/vulnerability/CVE-2024-39702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39702 · Security Note
• https://t.me/cveNotify/136266 · Telegram Post
• https://t.me/cvenotify/87135 · Telegram Post
• https://t.me/cvedetector/1518 · Telegram Post
• https://t.me/cvenotify/87205 · Telegram Post
• https://t.me/cvenotify/124971 · Telegram Post