Apache Seata Data Amplification Vulnerability Allowing Compression Bomb Attacks

A data amplification vulnerability due to improper handling of highly compressed data has been identified in Apache Seata (incubating) versions through 2.2.0. This vulnerability can lead to a compression bomb attack, where an attacker could exploit the way the application processes compressed data, potentially causing denial-of-service conditions by exhausting resources.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, where the application becomes unresponsive or unavailable due to resource exhaustion.

Remediation

Users are advised to upgrade to Apache Seata version 2.3.0, which addresses this vulnerability.