Description

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T16:17:29.097Z",
  "pubdate": "2026-08-20T16:17:29.097Z",
  "executiveSummary": "An Uncontrolled Resource Consumption vulnerability has been identified in Apache InLong, specifically impacting versions ranging from 2.0.0 before 2.4.0. This security flaw allows malicious actors or unauthorized users to manipulate operational configurations or facilitate the unauthorized upload of non-official packages into the target environment. The primary impact of this vulnerability involves the potential exhaustion of system resources, unauthorized modification of core operational parameters, and the introduction of untrusted software artifacts into the deployment pipeline. This poses severe risk implications for the integrity, availability, and overall security posture of affected systems. Attack capabilities include leveraging interface access to inject malicious payloads or non-official packages, which can degrade system performance or compromise execution integrity. Exploitation requirements rely on the ability of users to interact with vulnerable configuration or package management interfaces within the specified version range. Organizations utilizing Apache InLong are strongly advised to take immediate remedial action to mitigate potential abuse and secure their operational infrastructure against unauthorized configurations and arbitrary package uploads.",
  "technicalDetails": "The security issue identified in Apache InLong is classified as an Uncontrolled Resource Consumption vulnerability, impacting software versions from 2.0.0 before 2.4.0. The root cause stems from insufficient validation, sanitization, and rate-limiting mechanisms within the components responsible for handling operational configuration management and package ingestion routines. When unverified inputs or non-official packages are processed, the application fails to adequately constrain resource allocation or verify the authenticity of the ingested data and binaries.\nThe attack flow begins when an authenticated or network-positioned user interacts with vulnerable endpoints designed to accept configuration parameters or software packages. Because input validation controls are inadequate, an attacker can transmit crafted requests designed to bypass structural checks, allowing the upload of non-official packages or the alteration of sensitive operational configurations. Payload behavior during exploitation may manifest as excessive memory consumption, CPU exhaustion, or the persistence of untrusted binary artifacts within the application workspace.\nThe vulnerable components reside within the configuration management and package deployment subsystems of Apache InLong. Affected versions include all deployments running software iterations from 2.0.0 up to, but not including, 2.4.0. Depending on the specific deployment architecture, network exposure of these administrative or ingestion interfaces increases the attack surface, potentially exposing the service to remote exploitation. Post-exploitation impact encompasses operational instability, denial of service through resource exhaustion, and potential code execution if uploaded non-official packages are subsequently loaded or executed by the runtime environment."
}