Threats tagged 'ghsa-j7wj-xf6p-vhwp'

A vulnerability in AWX allows unauthenticated remote attackers to access debug API endpoints that trigger scheduler operations acquiring database advisory locks and opening transactions. This can lead to resource exhaustion and degraded service availability due to lock contention. The flaw arises because these debug endpoints are registered unconditionally and use permissive access controls. While the vulnerability does not allow data compromise, it can cause service degradation under sustained attack. No complete mitigation exists except applying a future update. Interim mitigations include restricting network access and blocking debug API paths.