Log in Start free

Vulnerability · Published Jun 23, 2021 · Assigned by GitHub_M

CVE-2021-32823Potential Denial-of-Service in bindata

Low 3.7

In plain English

A low-severity uncontrolled resource consumption in bindata from dmendel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)1.9%top 20.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-bindata2.4.14-1DEBIAN-CVE-2021-32823
Debian:13ruby-bindata2.4.14-1DEBIAN-CVE-2021-32823
Debian:14ruby-bindata2.4.14-1DEBIAN-CVE-2021-32823
RubyGemsbindata2.4.10GHSA-hj56-84jw-67h6
Ubuntu:22.04:LTSruby-bindatano fix listedUBUNTU-CVE-2021-32823
Ubuntu:24.04:LTSruby-bindatano fix listedUBUNTU-CVE-2021-32823
Ubuntu:25.10ruby-bindatano fix listedUBUNTU-CVE-2021-32823
Ubuntu:26.04:LTSruby-bindatano fix listedUBUNTU-CVE-2021-32823
Ubuntu:26.10ruby-bindatano fix listedUBUNTU-CVE-2021-32823

Affected products (as reported)

VendorProductVersions
dmendel bindata < 2.4.10

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References