{"id":"CVE-2023-38200","aliases":["GHSA-pg75-v6fp-8q59","PYSEC-2026-1489"],"title":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","summary":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"keylime","product":"keylime","ecosystem":"pip","affected":["keylime < 7.4.0"],"patched":["keylime 7.4.0"],"published":"2023-08-01","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pg75-v6fp-8q59","references":[{"url":"https://github.com/keylime/keylime/security/advisories/GHSA-pg75-v6fp-8q59"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38200"},{"url":"https://github.com/keylime/keylime/pull/1421"},{"url":"https://github.com/keylime/keylime/commit/c68d8f0b7ea549c12b6956ab0f3c28ae0360ae17"},{"url":"https://access.redhat.com/security/cve/CVE-2023-38200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222692"},{"url":"https://github.com/keylime/keylime"},{"url":"https://github.com/keylime/keylime/releases/tag/v7.4.0"}],"tags":["osv","pip"],"epss":0.01448,"epssPercentile":0.72177,"ingestedAt":"2026-07-08T18:25:51.759Z","slug":"CVE-2023-38200","body":"## Overview\n\n### Impact\nKeylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.\n\n### Patches\nUsers should upgrade to release 7.4.0\n\n## Affected packages\n\n- `keylime < 7.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `keylime 7.4.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}