CVE-2024-31209

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
erlef	oidcc	>= 3.0.0, < 3.0.2; >= 3.1.0, < 3.1.2; >= 3.2.0-beta.1, < 3.2.0-beta.3

References

Timeline

Published: Apr 4, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-31213.3A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerab CVE-2024-312108.8WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plug CVE-2024-312119.8WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution vi CVE-2024-312127.2InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacke CVE-2024-312135.4InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when bein CVE-2024-312149.6Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device ima CVE-2024-312154.3Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnera CVE-2024-312165.1The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositori CVE-2024-312176.5Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media uploa CVE-2024-312189.8Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and e CVE-2024-312194.3Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allow CVE-2024-31224.9CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with ad