Read the docs
TI-2023-16927 Aliases CVE-2023-34061GHSA-xr94-cv8c-7r6v

CVE-2023-34061 – Gorouter route pruning

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Fixed Routing Release (Cloud Foundry): 0.284.0CF deployment (Cloud Foundry): 33.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud FoundryRouting Release0.163.0 to before 0.284.00.284.0Patch availableCNA
Cloud FoundryCF deployment0.28.0 to before 33.6.033.6.0Patch availableCNA
  • Routing Release VendorCloud Foundry Affected 0.163.0 to before 0.284.0 Fixed in 0.284.0 Patch available CNA
  • CF deployment VendorCloud Foundry Affected 0.28.0 to before 33.6.0 Fixed in 33.6.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pivotal:cloud_foundry_deployment:*:*:*:*:*:*:*:*0.28.0 – 33.5.0VulnerablePivotal
cpe:2.3:a:pivotal:cloud_foundry_routing_release:*:*:*:*:*:*:*:*0.163.0 – 0.283.0VulnerablePivotal
  • cpe:2.3:a:pivotal:cloud_foundry_deployment:*:*:*:*:*:*:*:* Versions 0.28.0 – 33.5.0 Vulnerable ·Pivotal
  • cpe:2.3:a:pivotal:cloud_foundry_routing_release:*:*:*:*:*:*:*:* Versions 0.163.0 – 0.283.0 Vulnerable ·Pivotal

Remediation

  • Fix · CNA Routing Release (Cloud Foundry) Fixed in 0.284.0
  • Fix · CNA CF deployment (Cloud Foundry) Fixed in 33.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34061
  2. 2026-10-03 Alias added: GHSA-xr94-cv8c-7r6v

References

Advisory 1

  • TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
  • TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
  • TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
  • TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
  • TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
  • TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences