Denial Of Service (DoS)

amqp-client is vulnerable to Denial Of Service DoS. The vulnerability exists because the library does not incorporate the maximum inbound message size into the ConnectionFactory. As a result, an attacker can potentially cause an application crash by sending excessively large messages, leading to ...

RabbitMQ Resource Management Error Vulnerability

RabbitMQ is a feature-rich multi-protocol messaging and streaming agent from RabbitMQ open source. A security vulnerability exists in the RabbitMQ Java client versions prior to 5.18.0 that stems from allowing Java and JVM-based applications to connect to and interact with RabbitMQ nodes, where an...

OSV-2023-1059 Out-of-memory in IndexSearchFuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63512 Crash type: Out-of-memory Crash state: IndexSearchFuzzer...

netty: SniHandler 16MB allocation leads to OOM

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per...

PT-2023-32952

Name of the Vulnerable Software and Affected Versions Rustix versions prior to 0.35.15 Rustix versions prior to 0.36.16 Rustix versions prior to 0.37.25 Rustix versions prior to 0.38.19 Description The issue arises when using rustix::fs::Dir with the linux raw backend, where the iterator can get...

CVE-2023-39410

A flaw was found in apache-avro. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints, leading to an out-of-memory error and a denial of service on the system...

netty: SniHandler 16MB allocation leads to OOM

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per...

PT-2023-36058 · Git +1 · Lucene

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to an out-of-memory crash. The crash was identified by the IndexSearchFuzzer. No information is provided about the estimated number ...

netty: SniHandler 16MB allocation leads to OOM

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per...

Denial Of Service (DoS)

Apache Avro is vulnerable to Buffer Overflow. The vulnerability is due to improper handling of deserialization when processing untrusted or corrupted data. This can result in a reader consuming memory beyond the allowed constraints, potentially leading to an out-of-memory condition on the system...

GHSA-RHRV-645H-FJFH Apache Avro Java SDK vulnerable to Improper Input Validation

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

Apache Avro Java SDK vulnerable to Improper Input Validation

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

CVE-2023-39410

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

CVE-2023-39410 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

CVE-2023-39410

CVE-2023-39410 describes a memory exhaustion risk when deserializing untrusted data in the Apache Avro Java SDK. Affected: Avro Java SDK up to 1.11.2. Root cause: deserialization can consume memory beyond allowed constraints, leading to out-of-memory DoS. A fix is available in Apache Avro 1.11.3....

Deserialization of Untrusted Data

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

DEBIAN-CVE-2023-3223

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service DoS attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass...

UBUNTU-CVE-2023-3223

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service DoS attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass...

Red Hat Infinispan Security Vulnerability

Red Hat Infinispan is a distributed cache and key-value NoSQL datastore from Red Hat. Red Hat Infinispan suffers from a security vulnerability that stems from not detecting circular object references during ungrouping, which can be exploited by an attacker to insert maliciously constructed object...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-005)

The version of firefox installed on the remote host is prior to 102.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-005 advisory. A double-free in libwebp could have led to memory corruption and a potentially exploitable crash. CVE-2023-1999 I...