CVE-2024-38826
CVE-2024-38826 Cloud Controller Denial of Service Attack
Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.
The Cloud Foundry project recommends upgrading the following releases:
- Upgrade capi release version to 1.194.0 or greater
- Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
CVE-2024-38826 Cloud Controller Denial of Service Attack
Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.
The Cloud Foundry project recommends upgrading the following releases:
- Upgrade capi release version to 1.194.0 or greater
- Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
- Record
CVE-2024-38826- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2024-37642
Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.
The Cloud Foundry project recommends upgrading the following releases:
- Upgrade capi release version to 1.194.0 or greater
- Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
- Record
EUVD-2024-37642- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rmv6-pcxx-vfgj
Authenticated users can upload specifically crafted files to leak server resources. This behavior...
Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.
The Cloud Foundry project recommends upgrading the following releases:
- Upgrade capi release version to 1.194.0 or greater
- Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
- Record
GHSA-rmv6-pcxx-vfgj- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.
The Cloud Foundry project recommends upgrading the following releases:
- Upgrade capi release version to 1.194.0 or greater
- Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
- Record
CVE-2024-38826- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38826 is a medium vulnerability (CVSS 5.3) in Cloud Foundry Foundry, published November 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.