{"id":"CVE-2023-50248","aliases":["GHSA-7fgc-89cx-w8j5","PYSEC-2026-1249"],"title":"Out of memory error when submitting the dataset form with a specially-crafted field","summary":"Out of memory error when submitting the dataset form with a specially-crafted field","severity":"medium","cvss":4.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","vendor":"ckan","product":"ckan","ecosystem":"pip","affected":["ckan >= 2.0, < 2.9.10","ckan >= 2.10.0, < 2.10.3"],"patched":["ckan 2.9.10","ckan 2.10.3"],"published":"2023-12-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:59.391798976Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7fgc-89cx-w8j5","references":[{"url":"https://github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50248"},{"url":"https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be"},{"url":"https://github.com/ckan/ckan"}],"tags":["osv","pip"],"epss":0.00581,"epssPercentile":0.46451,"ingestedAt":"2026-07-08T18:25:46.989Z","slug":"CVE-2023-50248","body":"## Overview\n\n### Impact\n\nWhen submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.\n\nTo trigger this error the user needs to have permissions to create or edit datasets.\n\n### Patches\n\nThis vulnerability has been patched in CKAN 2.10.3 and 2.9.10\n\n## Affected packages\n\n- `ckan >= 2.0, < 2.9.10`\n- `ckan >= 2.10.0, < 2.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ckan 2.9.10`\n- `ckan 2.10.3`","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":24.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}