CVE-2023-3040 describes an out-of-bounds access vulnerability in a debug function within the Cloudflare lua-resty-json package. This flaw, present up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a, could lead to a Denial of Service (DoS) if the affected debug function processed untrusted input. The vulnerability is rated High severity with a CVSS score of 7.5, indicating a network-based attack with low complexity and high impact on availability (A:H). However, its practical exploitability is significantly mitigated as the vulnerable debug function was exclusively used in tests and demos, not in normal operational environments. Currently, there is no evidence of active exploitation, nor are there any public exploit codes available (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage are minimal, suggesting a low level of attention and concern regarding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2023-05-05CPE matchmatch criteria | cpe:2.3:a:cloudflare:lua-resty-json:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.