CVE-2024-21909
Denial of service in CBOR library
- State
- Published
- Severity
- 7.5 High
- Published
- Jan 3, 2024
- Updated
- Jul 14, 2026
- Reserved
- Jan 3, 2024
Description
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-407 Inefficient Algorithmic Complexity
Affected Products
| Product | Versions |
|---|---|
PeterO.Cbor |
|
References
- https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fgvendor-advisory
- https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95patch
- https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1related
- https://github.com/advisories/GHSA-6r92-cgxc-r5fgvendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fgthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.