CVE-2024-57623

CVE-2024-57623 affects the HEAP_malloc component in MonetDB Server version 11.49.1. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements. It is associated with CWE-404 (Improper Resource Shutdown or Release) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

The attack requires only network access with low complexity and no privileges, authentication, or user interaction. Remote, unauthenticated attackers can exploit it by crafting malicious SQL statements that cause resource exhaustion or improper memory handling in the HEAP_malloc function, leading to service disruption without compromising confidentiality or integrity.

Mitigation details are available in the referenced GitHub issue at https://github.com/MonetDB/MonetDB/issues/7415, which documents the vulnerability in MonetDB's repository.