CVE-2023-37475

Katalog CVE

CVSS 7.5 · High EPSS 0,96%

Kerentanan Uncontrolled Resource Consumption pada avro project avro. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

17 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45 exploit · advisory vendor
• https://github.com/hamba/avro/commit/b4a402f41cf44b6094b5131286830ba9bb1eb290 patch