Uncontrolled resource consumption in Cloud Foundry Routing release
Priority LOW 27CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.
Summary
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00581 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Foundry Routing release | Routing release versions from 0.262.0 and prior to 0.266.0 | — | No fix listed | CNA |
- Cloud Foundry Routing release Vendor— Affected Routing release versions from 0.262.0 and prior to 0.266.0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* | 27.4.0 to before 29.0.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:* | 0.262.0 to before 0.266.0 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions 27.4.0 to before 29.0.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:* Versions 0.262.0 to before 0.266.0 Vulnerable ·CloudFoundry Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-20882
- 2026-10-03 Alias added: GHSA-f2f8-4q6m-2pw8
References
More CloudFoundry Foundation Cf-deployment vulnerabilities
- TI-2022-13629 Improper certificate validation in Cloud Foundry Diego and CF Deployment CVSS 3.1CRITICAL 9.1
- TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
- TI-2019-08441 Password leak in smbdriver logs CVSS 3.1HIGH 8.8
- TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
- TI-2019-08446 A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVSS 3.1HIGH 8.6
- TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8
Sources
- CVE-2023-20882 · CVE Program
- CVE-2023-20882 · NVD
- FIRST EPSS
- GHSA-f2f8-4q6m-2pw8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences