VulnerabilityModified
CVE-2024-21909
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability.
HIGH 7.5EPSS 1.06%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.06% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-407
- Affected
- peteroupc/cbor
- Source
- disclosure@vulncheck.com
References
- https://github.com/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
- https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95Patch
- https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1Release Notes
- https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fgThird Party Advisory
- https://github.com/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
- https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95Patch
- https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1Release Notes
- https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fgThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.