GHSA-j7jw-28jm-whr6
lakeFS allows an authenticated user to cause a crash by exhausting server memory
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/treeverse/lakefs | < 1.50.0 | 1.50.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.
### Patches
This problem has been patched and exists in versions 1.49.1 and below
### Workarounds
On S3 backends, configure
```yaml
# ...
blockstore:
s3:
disable_pre_signed_multipart: true
```
or set environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true`.
### References
_Are there any links users can visit to find out more?_
References
External links from the advisory. They lead to third-party sites.