CVE-2022-35724
Denial of service while reading data in Avro Rust SDK
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Aug 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Affected products
Apache Software Foundation · Apache AvroWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →