CVE-2023-24997

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache InLong	>= 1.1.0, <= 1.5.0

References

https://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8Mailing List, Vendor Advisory
https://lists.apache.org/thread/nxvtxq7oxhwyzo9ty2hqz8rvh5r7ngd8Mailing List, Vendor Advisory

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-249987.5Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker CVE-2023-249998.1HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to dest CVE-2023-25008.8The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inclu CVE-2023-250004.7HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An a CVE-2023-250017.8A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vu CVE-2023-250027.8A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may CVE-2023-250037.8A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnera CVE-2023-250047.8A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vuln CVE-2023-250057.8A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL CVE-2023-250067.8A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in cod CVE-2023-250077.8A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code exec CVE-2023-250087.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result i