id: GO-2023-1872
modules:
    - module: github.com/openfga/openfga
      versions:
        - fixed: 1.1.1
      vulnerable_at: 1.1.1-0.20230623171216-d180fc3e227f
      packages:
        - package: github.com/openfga/openfga/pkg/typesystem
          symbols:
            - New
            - NewAndValidate
            - TypeSystem.validateNames
            - TypeSystem.validateRelationTypeRestrictions
summary: Denial of service in github.com/openfga/openfga
description: |-
    OpenFGA is vulnerable to a denial of service attack when certain Check and
    ListObjects calls are executed against authorization models that contain
    circular relationship definitions.
cves:
    - CVE-2023-35933
ghsas:
    - GHSA-hr9r-8phq-5x8j
references:
    - advisory: https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j
    - fix: https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452
review_status: REVIEWED