Vulnerability · Published Jan 3, 2024 · Assigned by VulnCheck

CVE-2024-21909Denial of service in CBOR library

High 7.5

In plain English

A high-severity security flaw in PeterO.Cbor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.1%top 35.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	petero.cbor	4.5.1	GHSA-6r92-cgxc-r5fg

Affected products (as reported)

Vendor	Product	Versions
	PeterO.Cbor	4.0.0 – before 4.5.1

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg vendor-advisory
https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95 patch
https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1 related
https://github.com/advisories/GHSA-6r92-cgxc-r5fg vendor-advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg third-party-advisory