Skip to content
OpenAdvisories
Medium · 5.3 CVE-2022-27897 EUVD-2022-32385GHSA-fcgx-8f7g-hw7g

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

Published Feb 16, 2023 · Updated Mar 18, 2025 · Assigned by Palantir

Description

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.

Affected products

VendorProductAffectedFixed
Palantir Gotham unspecified – < 3.22.11.2 3.22.11.2

References