CVE-2024-23684
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/01/2024
Last modified:
20/06/2025
Description
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application&#39;s use of this library, this may be a remote attacker.<br />
<br />
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:* | 4.0.0 (including) | 4.5.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/advisories/GHSA-fj2w-wfgv-mwq6
- https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6
- https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6
- https://github.com/advisories/GHSA-fj2w-wfgv-mwq6
- https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6
- https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6