Opencanary
Monthly
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.