CVE-2024-32886

4.9 MEDIUM
Published: May 08, 2024 Modified: April 15, 2026
View on NVD

Description

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79
Source: security-advisories@github.com
https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71
Source: security-advisories@github.com
https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df
Source: security-advisories@github.com
https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055
Source: security-advisories@github.com
https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d
Source: security-advisories@github.com
https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202
Source: security-advisories@github.com
https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2
Source: security-advisories@github.com
https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202
Source: af854a3a-2127-422b-91ae-364da2661108
https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2
Source: af854a3a-2127-422b-91ae-364da2661108

14 reference(s) from NVD

Quick Stats

CVSS v3 Score
4.9 / 10.0
EPSS (Exploit Probability)
0.1%
28th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-835

Related CVEs

CVE-2026-40962 4.9
CVE-2026-40505 3.3
CVE-2026-40504 9.8
CVE-2026-3299 6.4
CVE-2026-40960 8.1