CVE-2024-12289: Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.
This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12289?
CVE-2024-12289 is classified as a denial of service vulnerability due to improper handling of HTTP requests during the initialization of the Boundary controller.
How do I fix CVE-2024-12289?
To fix CVE-2024-12289, upgrade to Boundary version 0.18.3 or later where the issue has been addressed.
Which versions of Boundary are affected by CVE-2024-12289?
Boundary versions prior to 0.18.3, specifically up to 0.18.2, are affected by CVE-2024-12289.
What can happen if CVE-2024-12289 is exploited?
Exploitation of CVE-2024-12289 may lead to the premature termination of the Boundary server, resulting in service disruption.
Is CVE-2024-12289 a risk during normal operation?
CVE-2024-12289 is only a risk during the initialization phase of the Boundary controller.