CVE-2024-21909

HIGH

Peteroupc Cbor < 4.5.1 - Denial of Service

Title source: rule

Description

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

References (5)

[Third Party Advisory] https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg

[Patch] https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95

View Patch ZIP pw:eip

[Release Notes] https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1

[Third Party Advisory] https://github.com/advisories/GHSA-6r92-cgxc-r5fg

[Third Party Advisory] https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg

Scores

CVSS v3 7.5

EPSS 0.0047

EPSS Percentile 64.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-407

Status published

Products (2)

nuget/PeterO.Cbor 4.0.0 - 4.5.1NuGet

peteroupc/cbor 4.0.0 - 4.5.1

Published Jan 03, 2024

Tracked Since Feb 18, 2026