CVE-2023-45874: 
Couchbase vulnerability analysis and mitigation

A vulnerability (CVE-2023-45874) was discovered in Couchbase Server through version 7.2.2. The vulnerability allows a data reader to cause a denial of service by locking up reader threads. A user with Data Reader role could lock a Data Service reader thread for a significant time by requesting a high number of keys and potentially lock up all reader threads by issuing the same command on multiple connections (NVD, Couchbase Alerts).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The issue specifically involves the data reader's ability to cause an outage of reader threads through carefully crafted requests (NVD).

The vulnerability can result in a denial of service condition specifically affecting the Data Service reader threads. By exploiting this vulnerability, an attacker with Data Reader privileges could potentially disrupt service availability by locking up all reader threads (Security Online).

The vulnerability can be exploited by a user with Data Reader role by requesting a high number of keys and issuing the same command on multiple connections. No special conditions or user interaction is required beyond having the Data Reader role permissions (Couchbase Alerts).

The vulnerability has been fixed in Couchbase Server version 7.2.4. Users are advised to upgrade to this version or later to address the vulnerability (Couchbase Alerts).