CVE-2024-21909

2024-01-0316:15:09

CWE-407

VulnCheck

web.nvd.nist.gov

petero.cbor

cve-2024-21909

denial of service

vulnerability

security

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

48.4%

JSON

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of
service vulnerability. An attacker may trigger the denial of service
condition by providing crafted data to the DecodeFromBytes or other
decoding mechanisms in PeterO.Cbor. Depending on the usage of the
library, an unauthenticated and remote attacker may be able to cause the
denial of service condition.

Affected configurations

Nvd

Node

peteroupccborRange4.0.0–4.5.1.net

VendorProductVersionCPE
peteroupccbor*cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*

Vendor	Product	Version	CPE
peteroupc	cbor	*	cpe:2.3:a:peteroupc:cbor::::::.net::*

CNA Affected

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageName": "PeterO.Cbor",
    "versions": [
      {
        "lessThan": "4.5.1",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]