### [CVE-2024-32886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32886)
![](https://img.shields.io/static/v1?label=Product&message=vitess&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%2017.0.7%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%3A%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')&color=brighgreen)

### Description

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

### POC

#### Reference
- https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2
- https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds