Approved changes feed: RSS · Atom
cpe:2.3:a:hamba:avro:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Hamba (4cc9c562-0790-5f6a-8748-eec32b880fa9) |
|---|---|
| Product | Avro (78821ca9-0a5e-59fa-bbac-21bb748ca723) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-37475 |
vulnerable | 2026-06-08 06:08:15.412622 |
Attacker-controlled parameter can cause denial of service in hamba avro
HIGH (7.5)
Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2023-07-17T16:36:23.546Z
Updated: 2024-10-18T17:38:36.924Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.