Approved changes feed: RSS · Atom
cpe:2.3:a:avro_project:avro:*:*:*:*:*:go:*:*part: a version: * update: *
| Vendor | Avro Project (51774bb5-b210-5f45-9e83-afb942a0fa6a) |
|---|---|
| Product | Avro (e6cb73c6-a935-5542-9f4a-56a1c8d91151) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | go |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-37475 |
vulnerable | 2026-06-08 06:08:15.411955 |
Attacker-controlled parameter can cause denial of service in hamba avro
HIGH (7.5)
Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2023-07-17T16:36:23.546Z
Updated: 2024-10-18T17:38:36.924Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.