CVE-2024-21523

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash. **Note:** By providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-241

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-215249.1All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling TCVE-2024-215258.3All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcCVE-2024-215267.5All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyCVE-2024-215278.2Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenbergCVE-2024-215285.9All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improCVE-2024-215298.2Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. CVE-2024-21539.8A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown pCVE-2024-215304.5Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functCVE-2024-215315.3All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the proCVE-2024-215327.3All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bCVE-2024-215336.5All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL CVE-2024-215349.8All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can
CVE-2024-21523: High severity, CVSS 7.5 | Vulnix