Volto Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Volto, a ReactJS-based frontend for the Plone Content Management System. This issue affects Volto versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5. The vulnerability allows an anonymous user to cause the NodeJS server component of Volto to crash with an error by visiting a specific URL.

Impact

Exploitation of this vulnerability leads to a crash of the NodeJS server component, causing a denial-of-service condition.

Remediation

Users are advised to upgrade to Volto versions 16.34.1, 17.22.2, 18.27.2, or 19.0.0-alpha.6, where this vulnerability has been patched.