Read the docs
TI-2023-19872 Aliases CVE-2023-38492GHSA-3v6j-v3qc-cxff

Kirby vulnerable to denial of service from unlimited password lengths

Priority MEDIUM 41CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities. Kirby's authentication endpoint did not limit the password length. This allowed attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided password, which requires more CPU and memory resources (and therefore processing time) the longer the provided password gets. This could be abused by an attacker to cause the website to become unresponsive or unavailable. Because Kirby comes with a built-in brute force protection, the impact of this vulnerability is limited to 10 failed logins from each IP address and 10 failed logins for each existing user per hour. The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have added password length limits in the affected code so that passwords longer than 1000 bytes are immediately blocked, both when setting a password and when logging in.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01178 67th percentileScored 2026-11-07
Fix Fixed kirby (getkirby): 3.5.8.3, 3.6.6.3, 3.7.5.2 +2getkirby/cms (Packagist): 3.5.8.3, 3.6.6.3, 3.7.5.2 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkirbykirbybefore 3.5.8.3; 3.6.0 to before 3.6.6.3; 3.7.0 to before 3.7.5.2; 3.8.0 to before 3.8.41; 3.9.0 to before 3.9.63.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.41, 3.9.6Patch availableCNA
—getkirby/cms (Packagist)before 3.5.8.33.5.8.3Patch availableGHSA-3v6j-v3qc-cxff
—getkirby/cms (Packagist)3.6.0 to before 3.6.6.33.6.6.3Patch availableGHSA-3v6j-v3qc-cxff
—getkirby/cms (Packagist)3.7.0 to before 3.7.5.23.7.5.2Patch availableGHSA-3v6j-v3qc-cxff
—getkirby/cms (Packagist)3.8.0 to before 3.8.4.13.8.4.1Patch availableGHSA-3v6j-v3qc-cxff
—getkirby/cms (Packagist)3.9.0 to before 3.9.63.9.6Patch availableGHSA-3v6j-v3qc-cxff
  • kirby Vendorgetkirby Affected before 3.5.8.3; 3.6.0 to before 3.6.6.3; 3.7.0 to before 3.7.5.2; 3.8.0 to before 3.8.41; 3.9.0 to before 3.9.6 Fixed in 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.41, 3.9.6 Patch available CNA
  • getkirby/cms (Packagist) Vendor— Affected before 3.5.8.3 Fixed in 3.5.8.3 Patch available GHSA-3v6j-v3qc-cxff
  • getkirby/cms (Packagist) Vendor— Affected 3.6.0 to before 3.6.6.3 Fixed in 3.6.6.3 Patch available GHSA-3v6j-v3qc-cxff
  • getkirby/cms (Packagist) Vendor— Affected 3.7.0 to before 3.7.5.2 Fixed in 3.7.5.2 Patch available GHSA-3v6j-v3qc-cxff
  • getkirby/cms (Packagist) Vendor— Affected 3.8.0 to before 3.8.4.1 Fixed in 3.8.4.1 Patch available GHSA-3v6j-v3qc-cxff
  • getkirby/cms (Packagist) Vendor— Affected 3.9.0 to before 3.9.6 Fixed in 3.9.6 Patch available GHSA-3v6j-v3qc-cxff

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*3.5.0 to before 3.5.8.3; 3.6.0 to before 3.6.6.3; 3.7.0 to before 3.7.5.2; 3.8.0 to before 3.8.4.1; 3.9.0 to before 3.9.6Vulnerablegetkirby
  • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* Versions 3.5.0 to before 3.5.8.3; 3.6.0 to before 3.6.6.3; 3.7.0 to before 3.7.5.2; 3.8.0 to before 3.8.4.1; 3.9.0 to before 3.9.6 Vulnerable ·getkirby

Remediation

  • Fix · CNA kirby (getkirby) Fixed in 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.41, 3.9.6
  • Fix · GHSA-3v6j-v3qc-cxff getkirby/cms (Packagist) Fixed in 3.5.8.3 Advisory →
  • Fix · GHSA-3v6j-v3qc-cxff getkirby/cms (Packagist) Fixed in 3.6.6.3 Advisory →
  • Fix · GHSA-3v6j-v3qc-cxff getkirby/cms (Packagist) Fixed in 3.7.5.2 Advisory →
  • Fix · GHSA-3v6j-v3qc-cxff getkirby/cms (Packagist) Fixed in 3.8.4.1 Advisory →
  • Fix · GHSA-3v6j-v3qc-cxff getkirby/cms (Packagist) Fixed in 3.9.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38492
  2. 2026-10-03 Alias added: GHSA-3v6j-v3qc-cxff

References

Advisory 8

Other 1

  • TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
  • TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
  • TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
  • TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
  • TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
  • TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences