Read the docs
TI-2023-11365 Aliases CVE-2023-26141GHSA-3qc2-v3hp-6cv8

Uncontrolled resource consumption in sidekiq

Priority MEDIUM 41CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400 and CWE-345.

Summary

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00939 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial sidekiq: 7.1.3sidekiq (RubyGems): 7.1.3, 6.5.10Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—sidekiqbefore 7.1.37.1.3Patch availableCNA
—sidekiq (RubyGems)7.0.0 to before 7.1.37.1.3Patch availableGHSA-3qc2-v3hp-6cv8
—sidekiq (RubyGems)before 6.5.106.5.10Patch availableGHSA-3qc2-v3hp-6cv8
  • sidekiq Vendor— Affected before 7.1.3 Fixed in 7.1.3 Patch available CNA
  • sidekiq (RubyGems) Vendor— Affected 7.0.0 to before 7.1.3 Fixed in 7.1.3 Patch available GHSA-3qc2-v3hp-6cv8
  • sidekiq (RubyGems) Vendor— Affected before 6.5.10 Fixed in 6.5.10 Patch available GHSA-3qc2-v3hp-6cv8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*before 6.5.10; 7.0 to before 7.1.3Vulnerablecontribsys
  • cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:* Versions before 6.5.10; 7.0 to before 7.1.3 Vulnerable ·contribsys

Remediation

  • Fix · CNA sidekiq Fixed in 7.1.3
  • Fix · GHSA-3qc2-v3hp-6cv8 sidekiq (RubyGems) Fixed in 7.1.3 Advisory →
  • Fix · GHSA-3qc2-v3hp-6cv8 sidekiq (RubyGems) Fixed in 6.5.10 Advisory →

Red Hat 1 advisory

  • RHSA-2024:0797 Released 2024-02-13 · Red Hat rating Important
    Satellite 6.14.2 Async Security Update
    • Red Hat Satellite 6.14 for RHEL 8 candlepin-4.3.11-1.el8sat, candlepin-selinux-4.3.11-1.el8sat, mosquitto-2.0.17-1.el8sat +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2024:0797
Not affected: 1 product
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26141
  2. 2026-10-03 Alias added: GHSA-3qc2-v3hp-6cv8

References

Exploit 1

Patch 1

Advisory 1

Other 5

  • TI-2023-01778 Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq CVSS 3.1CRITICAL 9.6
  • TI-2023-25350 Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker… CVSS 3.1MEDIUM 6.1
  • TI-2023-25349 Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker… CVSS 3.1MEDIUM 6.1
  • TI-2022-07850 In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days… CVSS 3.1HIGH 7.5
  • TI-2021-10692 Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences