What’s Vulnerable › Vulnerabilities

CVE-2023-50709: Denial of service attack on the cube-api endpoint

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-13 · updated 2026-06-17
• Weakness: CWE-20

Description

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the recommendation is to upgrade.

Affected products

• cube-js cube: before 0.34.34 — fixed in 0.34.34

How to fix

Upgrade to a fixed version: cube-js cube 0.34.34. Check the vendor advisory for mitigations.

References

• https://github.com/cube-js/cube/releases/tag/v0.34.34
• https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm
• https://github.com/cube-js/cube/releases/tag/v0.34.34
• https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm

Get alerted when CVE-2023-50709 or the next vulnerability affects your stack