CVE-2024-21909

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Inefficient Algorithmic Complexity pada peteroupc cbor. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Rincian

Terbit di NVD

3 Januari 2024

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95 patch
• https://github.com/advisories/GHSA-6r92-cgxc-r5fg advisory pihak ketiga
• https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg advisory pihak ketiga
• https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg advisory pihak ketiga
• https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1 release notes