CVE-2023-50248
CKAN out of memory error when submitting the dataset form with a specially-crafted field
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
CKAN out of memory error when submitting the dataset form with a specially-crafted field
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
- Record
CVE-2023-50248- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
EUVDEUVD-2023-3144
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
- Record
EUVD-2023-3144- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7fgc-89cx-w8j5
Out of memory error when submitting the dataset form with a specially-crafted field
Impact
When submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.
To trigger this error the user needs to have permissions to create or edit datasets.
Patches
This vulnerability has been patched in CKAN 2.10.3 and 2.9.10
- Record
GHSA-7fgc-89cx-w8j5- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
NVD
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
- Record
CVE-2023-50248- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSV
CKAN out of memory error when submitting the dataset form with a specially-crafted field
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
- Record
CVE-2023-50248- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVGHSA-7fgc-89cx-w8j5
Out of memory error when submitting the dataset form with a specially-crafted field
Impact
When submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.
To trigger this error the user needs to have permissions to create or edit datasets.
Patches
This vulnerability has been patched in CKAN 2.10.3 and 2.9.10
- Record
GHSA-7fgc-89cx-w8j5- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVPYSEC-2026-1249
Out of memory error when submitting the dataset form with a specially-crafted field
Impact
When submitting a POST request to the /dataset/new endpoint (including either the auth cookie or the Authorization header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.
To trigger this error the user needs to have permissions to create or edit datasets.
Patches
This vulnerability has been patched in CKAN 2.10.3 and 2.9.10
- Record
PYSEC-2026-1249- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckanPyPI |
2.0 up to 2.9.10 | 2.9.10 |
ckanPyPI |
2.10.0 up to 2.10.3 | 2.10.3 |
ckanPyPI |
2.0 up to 2.9.10, plus listed versions 2.0.12.0.72.0.82.12.1.1 Show 45 moreShow less2.1.52.1.62.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.4.52.4.82.4.92.5.02.5.12.5.22.5.32.5.42.5.62.5.72.5.82.5.92.6.02.6.12.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.22.7.3 |
2.9.10 |
ckanPyPI |
2.10.0 up to 2.10.3, plus listed versions 2.10.1 |
2.10.3 |
ckanPyPI |
2.0 up to 2.9.10, 2.10.0 up to 2.10.3, plus listed versions 2.0.12.0.72.0.82.12.1.1 Show 45 moreShow less2.1.52.1.62.10.12.22.2.12.2.32.2.42.32.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.4.52.4.82.4.92.5.02.5.12.5.22.5.32.5.42.5.62.5.72.5.82.5.92.6.02.6.12.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.2 |
2.9.102.10.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50248 is a medium vulnerability (CVSS 4.5) in Ckan, published December 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in ckan 2.9.10.
References
github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5
nvd.nist.gov/vuln/detail/CVE-2023-50248
pypi.org/project/ckan
Left out here: 59 versions. The JSON record has them.