CVE-2024-27284

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-272856.1YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scriptin CVE-2024-272866.5Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, CVE-2024-272878.7ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, CVE-2024-272883.11Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain CVE-2024-272898.1pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met CVE-2024-27296.1The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final CVE-2024-272906.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including CVE-2024-272916.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an CVE-2024-272927.5Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access CVE-2024-272947.8dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the CVE-2024-272958.2Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows CVE-2024-272965.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number