Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA altair (nexryai) Fixed in v12.24Q4.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-56200
References
More nexryai vulnerabilities
- TI-2023-26760 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation CVSS 3.1HIGH 8.6
- TI-2025-18602 Concorde CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.6
- TI-2023-28521 External apps using tokens issued by administrators and moderators can call admin APIs CVSS 3.1CRITICAL 9.8
- TI-2025-18653 Concorde not removing authentication tokens after logging out CVSS 3.1CRITICAL 9.4
- TI-2023-23496 Nexkey allows users to bypass authentication of Bull dashboard CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences