EUVD-2026-34778
GHSA-2vrg-7rqv-prf9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Inefficient algorithmic complexity in bytedance InfiniStore up to version 0.2.33 allows a local, low-privileged attacker to partially degrade availability by triggering worst-case execution in the purge_kv_map function. The CVSS vector (AV:L/AC:L/PR:L/UI:N/A:L) confirms limited blast radius - local-only access with no confidentiality or integrity impact - but a public proof-of-concept exists per the GitHub issue tracker and is reflected in the E:P temporal modifier. No patch has been issued; the vendor has not responded to the coordinated disclosure.
Technical ContextAI
InfiniStore is a distributed key-value storage library by ByteDance. The vulnerable component is the KV Map Handler, specifically the purge_kv_map function defined in /src/infinistore.h (CPE: cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*). CWE-407 (Inefficient Algorithmic Complexity) describes a root cause where an algorithm's worst-case time or resource complexity can be reached via attacker-controlled inputs - commonly referred to as algorithmic complexity or 'Hash-DoS' style attacks. In map structures, this typically manifests as degraded performance when a large or specially structured dataset forces O(n²) or similarly expensive traversal during a purge or cleanup operation. The RC:R temporal modifier in the CVSS vector indicates the vulnerability is reported with reasonable but not fully confirmed confidence.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor was informed through coordinated disclosure via an issue report but has not responded. Organizations running InfiniStore should restrict local shell and process access to hosts running InfiniStore to only trusted, necessary accounts - reducing the pool of users who can trigger the purge_kv_map code path. If InfiniStore is deployed in a shared or multi-tenant environment, consider isolating it to a dedicated host or container with strict user namespace restrictions; this limits lateral exploitation even if a lower-privileged account is compromised. Monitoring the InfiniStore process for anomalous CPU or memory usage during purge operations can serve as a detection control. Organizations should track the upstream GitHub repository at https://github.com/bytedance/InfiniStore/ and the VulDB advisory at https://vuldb.com/vuln/368398 for any future patch release.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today