{"id":"CVE-2024-31209","aliases":["EUVD-2024-1249","GHSA-mj35-2rgf-cv8p"],"status":"published","title":"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location","description":"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00235,"percentile":0.14625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-04-03T16:46:30Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Hex","package":"oidcc","fixed_in":["3.0.2","3.1.2","3.2.0-beta.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-beta.1"},{"fixed":"3.2.0-beta.3"}]}]},{"source":"osv","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}],"versions":["3.0.0","3.0.1"]},{"source":"osv","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}],"versions":["3.1.0","3.1.1","3.1.2-beta.1"]},{"source":"osv","ecosystem":"Hex","package":"oidcc","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0-beta.1"},{"fixed":"3.2.0-beta.3"}]}],"versions":["3.2.0-beta.1","3.2.0-beta.2"]}],"products":[{"vendor":"erlef","product":"oidcc"}],"references":[{"url":"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31209","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mj35-2rgf-cv8p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31209.json","tags":["advisory"]},{"url":"https://github.com/erlef/oidcc","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-31209","title":"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location","description":"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.","status":"published","published":"2024-04-04T16:04:43.255Z","modified":"2024-09-03T18:26:21.909Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-1249","description":"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.","status":"published","published":"2024-04-04T16:04:43Z","modified":"2024-09-03T18:26:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:56:05.029422Z"}],"ghsa":[{"id":"GHSA-mj35-2rgf-cv8p","title":"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location","description":"### Impact\n\nDOS by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`.\n\nSince the name is usually provided as a static value in the application using `oidcc`, this is unlikely to be exploited.\n\n### Details\n\nExample to illustrate the vulnerability.\n\n```erlang\n{ok, Claims} =\n  oidcc:retrieve_userinfo(\n    Token,\n    myapp_oidcc_config_provider,\n    \u003c\u003c\"client_id\"\u003e\u003e,\n    \u003c\u003c\"client_secret\"\u003e\u003e,\n    #{}\n  )\n```\n\nThe vulnerability is present in `oidcc_provider_configuration_worker:get_ets_table_name/1`.\nThe function `get_ets_table_name` is calling `erlang:list_to_atom/1`.\n\nhttps://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\n\nThere might be a case (Very highly improbable) where the 2nd argument of\n`oidcc_provider_configuration_worker:get_*/1` is called with a different atom each time which eventually leads to\nthe atom table filling up and the node crashing.\n\n### Patches\n\nPatched in `3.0.2`, `3.1.2` \u0026 `3.2.0-beta.3`\n\n### Workarounds\n\nMake sure only valid provider configuration worker names are passed to the functions.\n\n### References\n\n* https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html\n* https://www.cve.org/CVERecord?id=CVE-2024-31209\n* https://euvd.enisa.europa.eu/enisa/EUVD-2024-1249\n* https://github.com/advisories/GHSA-mj35-2rgf-cv8p","status":"published","published":"2024-04-03T16:46:30Z","modified":"2025-04-04T01:10:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2024-31209","description":"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.","status":"published","published":"2024-04-04T16:15:09.55Z","modified":"2026-06-17T07:27:59.177Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-31209","title":"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location","description":"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.","status":"published","published":"2024-04-04T16:04:43.255Z","modified":"2026-10-28T02:30:55.207351259Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-mj35-2rgf-cv8p","title":"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location","description":"### Impact\n\nDOS by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`.\n\nSince the name is usually provided as a static value in the application using `oidcc`, this is unlikely to be exploited.\n\n### Details\n\nExample to illustrate the vulnerability.\n\n```erlang\n{ok, Claims} =\n  oidcc:retrieve_userinfo(\n    Token,\n    myapp_oidcc_config_provider,\n    \u003c\u003c\"client_id\"\u003e\u003e,\n    \u003c\u003c\"client_secret\"\u003e\u003e,\n    #{}\n  )\n```\n\nThe vulnerability is present in `oidcc_provider_configuration_worker:get_ets_table_name/1`.\nThe function `get_ets_table_name` is calling `erlang:list_to_atom/1`.\n\nhttps://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\n\nThere might be a case (Very highly improbable) where the 2nd argument of\n`oidcc_provider_configuration_worker:get_*/1` is called with a different atom each time which eventually leads to\nthe atom table filling up and the node crashing.\n\n### Patches\n\nPatched in `3.0.2`, `3.1.2` \u0026 `3.2.0-beta.3`\n\n### Workarounds\n\nMake sure only valid provider configuration worker names are passed to the functions.\n\n### References\n\n* https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html\n* https://www.cve.org/CVERecord?id=CVE-2024-31209\n* https://euvd.enisa.europa.eu/enisa/EUVD-2024-1249\n* https://github.com/advisories/GHSA-mj35-2rgf-cv8p","status":"published","published":"2024-04-03T16:46:30Z","modified":"2025-12-10T00:29:48.08277Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}