CVE-2024-21909 Denial of service in CBOR library

2024-01-0315:41:57

CWE-407

VulnCheck

www.cve.org

cve-2024-21909

denial of service

cbor library

petero.cbor

decodefrombytes

crafting data

remote attacker

unauthenticated

EPSS

0.001

Percentile

48.4%

JSON

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of
service vulnerability. An attacker may trigger the denial of service
condition by providing crafted data to the DecodeFromBytes or other
decoding mechanisms in PeterO.Cbor. Depending on the usage of the
library, an unauthenticated and remote attacker may be able to cause the
denial of service condition.

CNA Affected

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageName": "PeterO.Cbor",
    "versions": [
      {
        "lessThan": "4.5.1",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]