---
id: CVE-2024-34079
aliases:
  - GHSA-75r6-6jg8-pfcq
  - GO-2024-2833
title: >-
  octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and
  memory usage
summary: >-
  octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and
  memory usage
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
vendor: octo-sts
product: github.com/octo-sts/app
ecosystem: go
affected:
  - github.com/octo-sts/app < 0.1.0
patched:
  - github.com/octo-sts/app 0.1.0
published: '2024-05-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:13.274231043Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-75r6-6jg8-pfcq'
references:
  - url: 'https://github.com/octo-sts/app/security/advisories/GHSA-75r6-6jg8-pfcq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-34079'
  - url: >-
      https://github.com/octo-sts/app/commit/74ba874c017cf973edd6711144cf4399a9fcff57
  - url: 'https://github.com/octo-sts/app'
tags:
  - osv
  - go
epss: 0.00581
epssPercentile: 0.46499
ingestedAt: '2026-09-12T03:13:01.762Z'
---

## Overview

### Impact
This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service.

### Patches
This vulnerability existed in the repository at HEAD, we will cut a 0.1.0 release with the fix. 

### Workarounds
None

### References
None


## Affected packages

- `github.com/octo-sts/app < 0.1.0`

## Remediation

Upgrade to a patched release:

- `github.com/octo-sts/app 0.1.0`