---
id: CVE-2023-50248
aliases:
  - GHSA-7fgc-89cx-w8j5
  - PYSEC-2026-1249
title: >-
  Out of memory error when submitting the dataset form with a specially-crafted
  field
summary: >-
  Out of memory error when submitting the dataset form with a specially-crafted
  field
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H'
vendor: ckan
product: ckan
ecosystem: pip
affected:
  - 'ckan >= 2.0, < 2.9.10'
  - 'ckan >= 2.10.0, < 2.10.3'
patched:
  - ckan 2.9.10
  - ckan 2.10.3
published: '2023-12-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:59.391798976Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7fgc-89cx-w8j5'
references:
  - url: 'https://github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-50248'
  - url: >-
      https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be
  - url: 'https://github.com/ckan/ckan'
tags:
  - osv
  - pip
epss: 0.00581
epssPercentile: 0.45312
ingestedAt: '2026-07-08T18:25:46.989Z'
---

## Overview

### Impact

When submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.

To trigger this error the user needs to have permissions to create or edit datasets.

### Patches

This vulnerability has been patched in CKAN 2.10.3 and 2.9.10

## Affected packages

- `ckan >= 2.0, < 2.9.10`
- `ckan >= 2.10.0, < 2.10.3`

## Remediation

Upgrade to a patched release:

- `ckan 2.9.10`
- `ckan 2.10.3`