What’s Vulnerable › Vulnerabilities

CVE-2023-4540: DoS in lua-http library

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-05 · updated 2026-06-17
• Weakness: CWE-755

Description

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. This issue affects lua-http: all versions before commit ddab283.

Affected products

• Daurnimator Lua-Http: 0.4

References

• https://cert.pl/en/posts/2023/09/CVE-2023-4540/
• https://cert.pl/posts/2023/09/CVE-2023-4540/
• https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6
• https://cert.pl/posts/2023/09/CVE-2023-4540/
• https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6
• https://https://cert.pl/en/posts/2023/09/CVE-2023-4540/

Get alerted when CVE-2023-4540 or the next vulnerability affects your stack