CVE-2023-38976
Weaviate denial of service vulnerability
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
- Record
CVE-2023-38976- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
- Record
CVE-2023-38976- Updated
- 2026-11-02
EUVDEUVD-2023-2241 No score
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
- Record
EUVD-2023-2241- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8697-479h-5mfp
Weaviate denial of service vulnerability
Impact
This vulnerability is a type conversion issue that affects users of Weaviate Server versions 1.20.0 and earlier. Who is impacted: Users of Weaviate Server versions 1.20.0 and earlier are impacted by this vulnerability.
Patches
A patch has been developed for this vulnerability. Patch releases 1.20.6, 1.19.13, and 1.18.6 are fixing this vulnerability in each respective minor version release. Users are strongly recommended to upgrade to one of these patched versions to address the vulnerability. Keeping software up-to-date is crucial to avoid security vulnerabilities.
Workarounds
There are no known workarounds to fix or remediate this vulnerability without upgrading. Users must upgrade to a patched version to mitigate the risk.
References
- Record
GHSA-8697-479h-5mfp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-704
- Updated
- 2026-11-02
OSVGHSA-8697-479h-5mfp
Weaviate denial of service vulnerability
Impact
This vulnerability is a type conversion issue that affects users of Weaviate Server versions 1.20.0 and earlier. Who is impacted: Users of Weaviate Server versions 1.20.0 and earlier are impacted by this vulnerability.
Patches
A patch has been developed for this vulnerability. Patch releases 1.20.6, 1.19.13, and 1.18.6 are fixing this vulnerability in each respective minor version release. Users are strongly recommended to upgrade to one of these patched versions to address the vulnerability. Keeping software up-to-date is crucial to avoid security vulnerabilities.
Workarounds
There are no known workarounds to fix or remediate this vulnerability without upgrading. Users must upgrade to a patched version to mitigate the risk.
References
- Record
GHSA-8697-479h-5mfp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-704
- Updated
- 2026-11-02
OSV No score
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
- Record
CVE-2023-38976- Updated
- 2026-11-02
OSVGO-2023-2017 No score
Denial of service vulnerability in github.com/weaviate/weaviate
A type conversion issue in Weaviate may allow a remote attack that would cause a denial of service.
- Record
GO-2023-2017- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/weaviate/weaviateGo |
1.20.0 up to 1.20.6 | 1.20.6 |
github.com/weaviate/weaviateGo |
1.19.0 up to 1.19.13 | 1.19.13 |
github.com/weaviate/weaviateGo |
before 1.18.6 | 1.18.6 |
github.com/weaviate/weaviateGo |
before 1.18.6, 1.19.0 up to 1.19.13, 1.20.0 up to 1.20.6 | 1.18.61.19.131.20.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38976 is a high vulnerability (CVSS 7.5) in Weaviate, published August 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in github.com/weaviate/weaviate 1.20.6.
References
github.com/weaviate/weaviate/issues/3258
aisec.today/Weaviate-26981c6c5f794077bd51d24c88cebf7a
nvd.nist.gov/vuln/detail/CVE-2023-38976