GHSA-4xcv-9jjx-gfj3
Denial of Service in mem
Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.
Recommendation
Upgrade to version 4.0.0 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Denial of Service in mem
Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.
Recommendation
Upgrade to version 4.0.0 or later.
- Record
GHSA-4xcv-9jjx-gfj3- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Denial of Service in mem
Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.
Recommendation
Upgrade to version 4.0.0 or later.
- Record
GHSA-4xcv-9jjx-gfj3- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1771546202No score
TuxCare security update for mem (1 CVE)
TuxCare rebuilt mem to address 1 CVE. Fixed in 1.1.0-tuxcare.2.
- Record
CLSA-2026-1771546202- Updated
- 2026-11-02
OSVCLSA-2026-1793867525No score
TuxCare security update for mem (1 CVE)
TuxCare rebuilt mem to address 1 CVE. Fixed in 1.1.0-tuxcare.3.
- Record
CLSA-2026-1793867525- Updated
- 2026-11-05
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4xcv-9jjx-gfj3 is a medium vulnerability (CVSS 5.1) in mem, published July 5, 2019. No source lists public exploit code. Fixed in mem 4.0.0.