CVE-2024-32886— Vitess vulnerable to infinite memory consumption and vtgate crash
Quick assessment
Affected
vitessio vitess
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vitess是Vitess的一个用于水平扩展 MySQL 的数据库集群系统。 Vitess 19.0.4之前、18.0.5 之前、 17.0.7之前版本存在安全漏洞，该漏洞源于当执行简单的查询会导致无限的内存消耗。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-32886
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vitess vulnerable to infinite memory consumption and vtgate crash
Source: CVE Program / CVE List V5
Vulnerability Description
Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
Vitess 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vitess是Vitess的一个用于水平扩展 MySQL 的数据库集群系统。 Vitess 19.0.4之前、18.0.5 之前、 17.0.7之前版本存在安全漏洞，该漏洞源于当执行简单的查询会导致无限的内存消耗。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-32886
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-32886
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-32886 (4)
Vendor Advisories for CVE-2024-32886 (1)
-
https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2 x_refsource_CONFIRM
Other References for CVE-2024-32886 (2)
IV. Related Vulnerabilities
Same product: vitess
-
CVE-2026-65959
Vitess: Missing authorization on vttablet /debug/vrlog expos -
CVE-2026-27969
Vitess users with backup storage access can write to arbitra -
CVE-2026-27965
Vitess users with backup storage access can gain unauthorize -
CVE-2024-53257
Vitess allows HTML injection in /debug/querylogz & /debug/en -
CVE-2023-29195
Vitess VTAdmin users that can create shards can deny access
Same vendor: vitessio
-
CVE-2026-65959
Vitess: Missing authorization on vttablet /debug/vrlog expos -
CVE-2026-27969
Vitess users with backup storage access can write to arbitra -
CVE-2026-27965
Vitess users with backup storage access can gain unauthorize -
CVE-2024-53257
Vitess allows HTML injection in /debug/querylogz & /debug/en -
CVE-2023-29195
Vitess VTAdmin users that can create shards can deny access
Same weakness: CWE-835
-
CVE-2026-107577
Loop with Unreachable Exit Condition ('Infinite Loop') in hM -
CVE-2026-106164
Infinite Loop in Telerik Document Processing XLS Import -
CVE-2026-106568
ImageMagick: Infinite Loop when reading a crafted XMP profil -
CVE-2026-107168
M17n-lib: parser infinite loop on malformed utf-8 in count_u -
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never te
V. Comments for CVE-2024-32886
No comments yet