TI-2023-27476 Aliases CVE-2023-50248 GHSA-7fgc-89cx-w8j5

CKAN out of memory error when submitting the dataset form with a specially-crafted field

LOW 30CWE-130Published 2023-12-13 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.

Why it matters now

EPSS 0.00581 47th percentileScored 2026-11-07

Fix Fixed ckan (ckan): 2.9.10, 2.10.3ckan (PyPI): 2.9.10, 2.10.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ckan	ckan	2.0.0 to before 2.9.10; 2.10.0 to before 2.10.3	2.9.10, 2.10.3	Patch available	CNA
—	ckan (PyPI)	2.0 to before 2.9.10	2.9.10	Patch available	GHSA-7fgc-89cx-w8j5
—	ckan (PyPI)	2.10.0 to before 2.10.3	2.10.3	Patch available	GHSA-7fgc-89cx-w8j5

ckan Vendorckan Affected 2.0.0 to before 2.9.10; 2.10.0 to before 2.10.3 Fixed in 2.9.10, 2.10.3 Patch available CNA
ckan (PyPI) Vendor— Affected 2.0 to before 2.9.10 Fixed in 2.9.10 Patch available GHSA-7fgc-89cx-w8j5
ckan (PyPI) Vendor— Affected 2.10.0 to before 2.10.3 Fixed in 2.10.3 Patch available GHSA-7fgc-89cx-w8j5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:okfn:ckan::::::::	2.0 to before 2.9.10; 2.10.0 to before 2.10.3	Vulnerable	ckan

cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:* Versions 2.0 to before 2.9.10; 2.10.0 to before 2.10.3 Vulnerable ·ckan

Remediation

Fix · CNA ckan (ckan) Fixed in 2.9.10, 2.10.3
Fix · GHSA-7fgc-89cx-w8j5 ckan (PyPI) Fixed in 2.9.10 Advisory →
Fix · GHSA-7fgc-89cx-w8j5 ckan (PyPI) Fixed in 2.10.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-50248
2026-10-03 Alias added: GHSA-7fgc-89cx-w8j5

References

Patch 1

https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be

Advisory 2

Other 1

https://github.com/ckan/ckan

TI-2026-29863 CKAN: CSRF exemption primed by anonymous requests CVSS 3.1MEDIUM 6.1
TI-2021-07973 CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload CVSS 3.1MEDIUM 5.4
TI-2023-15615 CKAN remote code execution and private information access via crafted resource ids CVSS 3.1CRITICAL 9.8
TI-2026-30410 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` CVSS 4.0HIGH 8.3
TI-2023-08919 CKAN is vulnerable to session secret shared across instances using Docker images CVSS 3.1HIGH 8.6
TI-2023-15972 Excessive permissions for ckan user CVSS 3.1HIGH 8.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences