GHSA-pw2q-qwvj-gh43
Cache Flooding in TYPO3 Frontend
GHSA-pw2q-qwvj-gh43 is a medium vulnerability (CVSS 5.3) in typo3/cms, published June 5, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.27.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.2.27typo3/cms +5 more
Description
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.27 | 6.2.27 |
typo3/cmsPackagist | 7.6.0 up to 7.6.11 | 7.6.11 |
typo3/cmsPackagist | 8.0.0 up to 8.3.1 | 8.3.1 |
typo3/cmsPackagist | 6.2.0 up to 6.2.27, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 22 moreShow less6.2.136.2.146.2.156.2.166.2.176.2.186.2.196.2.26.2.206.2.216.2.226.2.236.2.246.2.256.2.266.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.27 |
typo3/cmsPackagist | 7.6.0 up to 7.6.11, plus listed versions 7.6.17.6.107.6.27.6.37.6.4 Show 5 moreShow less7.6.57.6.67.6.77.6.87.6.9 | 7.6.11 |
typo3/cmsPackagist | 8.0.0 up to 8.3.1, plus listed versions 8.0.18.1.08.1.18.1.28.2.08.2.18.3.0 | 8.3.1 |
What each source reports
GitHub Advisories Score used
Cache Flooding in TYPO3 Frontend
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
- Record
GHSA-pw2q-qwvj-gh43- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
Cache Flooding in TYPO3 Frontend
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
- Record
GHSA-pw2q-qwvj-gh43- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.