OpenID Connect client Atom Exhaustion in provider configuration worker ets table location
Priority LOW 24CWE-400Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed oidcc (erlef): 3.0.2, 3.1.2, 3.2.0-beta.3oidcc (Hex): 3.0.2, 3.1.2, 3.2.0-beta.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| erlef | oidcc | 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2; 3.2.0-beta.1 to before 3.2.0-beta.3 | 3.0.2, 3.1.2, 3.2.0-beta.3 | Patch available | CNA |
| — | oidcc (Hex) | 3.0.0 to before 3.0.2 | 3.0.2 | Patch available | GHSA-mj35-2rgf-cv8p |
| — | oidcc (Hex) | 3.1.0 to before 3.1.2 | 3.1.2 | Patch available | GHSA-mj35-2rgf-cv8p |
| — | oidcc (Hex) | 3.2.0-beta.1 to before 3.2.0-beta.3 | 3.2.0-beta.3 | Patch available | GHSA-mj35-2rgf-cv8p |
- oidcc Vendorerlef Affected 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2; 3.2.0-beta.1 to before 3.2.0-beta.3 Fixed in 3.0.2, 3.1.2, 3.2.0-beta.3 Patch available CNA
- oidcc (Hex) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-mj35-2rgf-cv8p
- oidcc (Hex) Vendor— Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-mj35-2rgf-cv8p
- oidcc (Hex) Vendor— Affected 3.2.0-beta.1 to before 3.2.0-beta.3 Fixed in 3.2.0-beta.3 Patch available GHSA-mj35-2rgf-cv8p
Remediation
- Fix · CNA oidcc (erlef) Fixed in 3.0.2, 3.1.2, 3.2.0-beta.3
- Fix · GHSA-mj35-2rgf-cv8p oidcc (Hex) Fixed in 3.0.2 Advisory →
- Fix · GHSA-mj35-2rgf-cv8p oidcc (Hex) Fixed in 3.1.2 Advisory →
- Fix · GHSA-mj35-2rgf-cv8p oidcc (Hex) Fixed in 3.2.0-beta.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31209
- 2026-10-03 Alias added: GHSA-mj35-2rgf-cv8p
References
Other 7
- https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p
- https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c
- https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649
- https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a
- https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388
- https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html
- https://github.com/erlef/oidcc
More erlef vulnerabilities
- TI-2026-53034 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc CVSS 4.0HIGH 7.6
Sources
- CVE-2024-31209 · CVE Program
- CVE-2024-31209 · NVD
- FIRST EPSS
- GHSA-mj35-2rgf-cv8p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences