CVE-2023-40052 is a High severity (CVSS 7.5) denial of service flaw in the WEB transport of Progress Application Server (PAS) for OpenEdge. A malformed web request can crash a PASOE agent. The record lists fixes in 11.7.18, 12.2.13 and 12.8.0, so upgrade to those releases or later.
What's affected
Affected, per the NVD record: Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. Fixed: 11.7.18, 12.2.13 and 12.8.0 or later.
I could not load Progress's own advisory page when preparing this post (it returned a page error instead of content), so these versions come from the NVD record. Confirm them against the Progress community advisory linked below before you plan a rollout.
How to check if you're exposed
Identify the OpenEdge release on each host that runs PASOE. The release is recorded in the version file under the OpenEdge install directory (the DLC directory), and your installer or change records should also show it. Then compare:
- 11.7 installs: below 11.7.18 is affected.
- 12.2 installs: below 12.2.13 is affected.
- Innovation releases: below 12.8.0 is affected.
Next, list which PASOE instances expose the WEB transport and which networks can reach them. Internet facing instances come first.
What to do now
- Inventory all OpenEdge hosts running PASOE and record their release.
- Upgrade to 11.7.18, 12.2.13 or 12.8.0 or later, depending on your release line, after confirming against the Progress advisory.
- Limit network reach to the WEB transport to trusted clients and put a gateway or WAF in front of exposed instances.
- Review upload directories and server logs for files or requests you do not recognize.
- Monitor PASOE agents for unexpected crashes or restarts.
Why it matters
The weakness class is CWE-119 (improper restriction of operations within a memory buffer). An attacker who can produce a malformed web request may crash a PASOE agent, which can disrupt the thread activities of many web application clients. Repeated attacks could flood the server with invalid requests compared with its remaining ability to process valid ones.
The record scores this High at CVSS 7.5, with an availability only impact. NVD published it on 2024-01-18. The KEV flag is false and I did not find a claim of exploitation in the sources available to me. For a service that many clients depend on, a request that crashes an agent can be repeated, so patching matters even when no data is at risk.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
Where do the fixed versions come from?
From the NVD record. Progress's advisory page did not load for this review, so confirm the numbers with Progress.
Is this exploited in the wild?
The KEV flag is false and no source I could read says so.
Sources
- Progress OpenEdge advisory (page did not load, versions taken from the NVD record)
Last reviewed: 19 October 2026.
