---
id: CVE-2023-29178
title: >-
  A access of uninitialized pointer vulnerability [CWE-824] vulnerability in
  Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS
  6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions,
  FortiProxy 7.2.0…
summary: >-
  A access of uninitialized pointer vulnerability [CWE-824] vulnerability in
  Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS
  6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions,
  FortiProxy 7.2.0…
severity: low
cvss: 3.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-824
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.2.0 <= 7.2.4
  - FortiOS >= 7.0.0 <= 7.0.11
  - FortiOS >= 6.4.0 <= 6.4.16
  - FortiOS >= 6.2.0 <= 6.2.17
  - FortiOS >= 6.0.0 <= 6.0.18
  - FortiProxy >= 7.2.0 <= 7.2.3
  - FortiProxy >= 7.0.0 <= 7.0.9
  - FortiProxy >= 2.0.0 <= 2.0.14
  - FortiProxy >= 1.2.1 <= 1.2.13
  - FortiProxy 01.02.00
  - FortiProxy >= 1.1.4 <= 1.1.6
  - FortiProxy >= 01.01.00 <= 01.01.03
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-22T20:17:55.847522Z'
published: '2023-06-13'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T13:48:27.713Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-29178'
references:
  - url: 'https://fortiguard.com/psirt/FG-IR-23-095'
    label: 'https://fortiguard.com/psirt/FG-IR-23-095'
tags:
  - cve.org
epss: 0.00949
epssPercentile: 0.61044
ingestedAt: '2026-10-22T22:00:50.272Z'
---

## Overview

A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.

## Affected

- `FortiOS >= 7.2.0 <= 7.2.4`
- `FortiOS >= 7.0.0 <= 7.0.11`
- `FortiOS >= 6.4.0 <= 6.4.16`
- `FortiOS >= 6.2.0 <= 6.2.17`
- `FortiOS >= 6.0.0 <= 6.0.18`
- `FortiProxy >= 7.2.0 <= 7.2.3`
- `FortiProxy >= 7.0.0 <= 7.0.9`
- `FortiProxy >= 2.0.0 <= 2.0.14`
- `FortiProxy >= 1.2.1 <= 1.2.13`
- `FortiProxy 01.02.00`
- `FortiProxy >= 1.1.4 <= 1.1.6`
- `FortiProxy >= 01.01.00 <= 01.01.03`

## Remediation

Upgrade to FortiProxy version 7.2.4 or above
Upgrade to FortiOS version 7.4.0 or above
Upgrade to FortiOS version 7.2.5 or above
Upgrade to FortiOS version 7.0.12 or above