Every CVE Search/ Get API key

CVE-2023-26141

sidekiq Denial of Service vulnerability

7.5 HighFix available

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.94%Up 0.9 points since Sep 14, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
CVE-2023-26141
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Weakness
CWE-400, CWE-400
Updated
2026-11-02
EUVDEUVD-2023-2408 7.5

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
EUVD-2023-2408
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Updated
2026-11-03
GitHub AdvisoriesGHSA-3qc2-v3hp-6cv8 5.7

sidekiq Denial of Service vulnerability

Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
GHSA-3qc2-v3hp-6cv8
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-345, CWE-400
Updated
2026-11-02
NVD 7.5

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
CVE-2023-26141
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-345
Updated
2026-11-02
OSV 7.5

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
CVE-2023-26141
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2023-26141 4.9

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
DEBIAN-CVE-2023-26141
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-3qc2-v3hp-6cv8 5.7

sidekiq Denial of Service vulnerability

Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
GHSA-3qc2-v3hp-6cv8
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-345, CWE-400
Updated
2026-11-02
OSVRHSA-2024:0797 8.1

Red Hat Security Advisory: Satellite 6.14.2 Async Security Update

Record
RHSA-2024:0797
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-26141 7.5

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Record
UBUNTU-CVE-2023-26141
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sidekiq
RubyGems
 7.0.0 up to 7.1.3
7.1.3
sidekiq
RubyGems
 before 6.5.10
6.5.10
sidekiq
RubyGems
 7.0.0 up to 7.1.3, plus listed versions
7.0.17.0.27.0.37.0.47.0.5
Show 7 moreShow less
7.0.67.0.77.0.87.0.97.1.07.1.17.1.2
7.1.3
sidekiq
RubyGems
 before 6.5.10, plus listed versions
0.10.00.10.10.11.00.11.10.11.2
Show 45 moreShow less
0.5.00.5.10.6.00.7.00.8.00.9.00.9.11.0.01.1.01.1.11.1.21.1.31.1.41.2.01.2.12.0.02.0.12.0.22.0.32.1.02.1.12.10.02.10.12.11.02.11.12.11.22.12.02.12.12.12.32.12.42.13.02.13.12.14.02.14.12.15.02.15.12.15.22.16.02.16.12.17.02.17.12.17.22.17.32.17.42.17.5
6.5.10
mosquitto
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
mosquitto-debuginfo
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
mosquitto-debugsource
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
mosquitto
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
mosquitto-debuginfo
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
mosquitto-debugsource
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:2.0.17-1.el8sat
0:2.0.17-1.el8sat
Show 11 moreShow less
Affected packages
PackageAffectedFixed
rubygem-grpc
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:1.58.0-1.el8sat
0:1.58.0-1.el8sat
puppetserver
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 10 CVEs
 before 0:7.14.0-1.el8sat
0:7.14.0-1.el8sat
puppetserver
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:7.14.0-1.el8sat
0:7.14.0-1.el8sat
rubygem-sidekiq
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:6.5.12-1.el8sat
0:6.5.12-1.el8sat
candlepin
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:4.3.11-1.el8sat
0:4.3.11-1.el8sat
candlepin-selinux
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:4.3.11-1.el8sat
0:4.3.11-1.el8sat
puppet-agent
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 10 CVEs
 before 0:7.27.0-1.el8sat
0:7.27.0-1.el8sat
puppet-agent
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:7.27.0-1.el8sat
0:7.27.0-1.el8sat
rubygem-puma
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:6.3.1-1.el8sat
0:6.3.1-1.el8sat
rubygem-puma-debuginfo
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:6.3.1-1.el8sat
0:6.3.1-1.el8sat
rubygem-puma-debugsource
Red Hat:satellite:6.14::el8
From an advisory covering 10 CVEs
 before 0:6.3.1-1.el8sat
0:6.3.1-1.el8sat

History

History
RecordedChangedSources
affected, facts
affected
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26141 is a high vulnerability (CVSS 7.5) in Contribsys Sidekiq, published September 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in sidekiq 7.1.3.

References

Show 74 moreShow less
This page doesn't list everything

Left out here: 134 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open