CVE-2023-39410

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394114.4Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local CVE-2023-394128.8Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via n CVE-2023-394137.8Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A speciall CVE-2023-394147.3Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A speciall CVE-2023-394157.5Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlie CVE-2023-394167.2Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1 CVE-2023-394178.8IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside CVE-2023-394184.3A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies define CVE-2023-394197.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-39427.5An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM device CVE-2023-394208.8The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" ac CVE-2023-394217.7The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services suc