id: GO-2023-2017
modules:
    - module: github.com/weaviate/weaviate
      versions:
        - fixed: 1.18.6
        - introduced: 1.19.0
          fixed: 1.19.13
        - introduced: 1.20.0
          fixed: 1.20.6
      vulnerable_at: 1.20.5
      packages:
        - package: github.com/weaviate/weaviate/adapters/handlers/rest
          symbols:
            - handleUnbatchedGraphQLRequest
          derived_symbols:
            - Server.ConfigureAPI
            - Server.Serve
            - Server.SetAPI
summary: Denial of service vulnerability in github.com/weaviate/weaviate
description: |-
    A type conversion issue in Weaviate may allow a remote attack that would cause a
    denial of service.
cves:
    - CVE-2023-38976
ghsas:
    - GHSA-8697-479h-5mfp
references:
    - advisory: https://github.com/weaviate/weaviate/security/advisories/GHSA-8697-479h-5mfp
    - report: https://github.com/weaviate/weaviate/issues/3258
    - fix: https://github.com/weaviate/weaviate/pull/3431
    - fix: https://github.com/weaviate/weaviate/commit/2a7b208d9aca07e28969e3be82689c184ccf9118
    - web: https://github.com/weaviate/weaviate/releases/tag/v1.18.6
    - web: https://github.com/weaviate/weaviate/releases/tag/v1.19.13
    - web: https://github.com/weaviate/weaviate/releases/tag/v1.20.6