Denial of Service Vulnerability in Narayana LRA Coordinator Component

CVE-2024-8447

Summary

A security vulnerability exists within the LRA Coordinator component of the Narayana transaction manager that can lead to significant application disruptions. The flaw arises when the Cancel operation is invoked, resulting in a delay of about 2 seconds. If a Join request is made with the same LRA ID during this interval, it may cause the application to crash or hang indefinitely, resulting in a denial of service. It is crucial for users of affected Narayana versions to implement appropriate mitigations to prevent potential service outages.

References