cve/2024/CVE-2024-1930.md

### [CVE-2024-1930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1930)
![](https://img.shields.io/static/v1?label=Product&message=dnf5daemon-server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%205.1.16%3C%3D%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brighgreen)

### Description

No Limit on Number of Open Sessions / Bad Session Close Behaviour  in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions.There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.

### POC

#### Reference
- https://www.openwall.com/lists/oss-security/2024/03/04/2

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds