CVE-2024-23684

HighCVSS 7.5/10Last modified Jul 14, 2026

Description

Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

Vendor	Product	Versions
—	—	>= 4.0.0, < 4.5.1

References

https://github.com/advisories/GHSA-fj2w-wfgv-mwq6Mitigation, Third Party Advisory
https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6Third Party Advisory
https://github.com/advisories/GHSA-fj2w-wfgv-mwq6Mitigation, Third Party Advisory
https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6Third Party Advisory

Timeline

Published: Jan 19, 2024
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236855.3Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to m CVE-2024-236865.3DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allo CVE-2024-236879.1Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access CVE-2024-236885.3Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every me CVE-2024-236898.8Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickho CVE-2024-23695.4The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting the CVE-2024-236907.2The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated CVE-2024-236929.8Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a CVE-2024-236957.8In CacheOpPMRExec of cache_km.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of CVE-2024-236967.8In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalati CVE-2024-236977.8In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escala CVE-2024-236987.8In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check. This could lead to l