cvelistv5 - cve-2024-21909

CVE-2024-21909 (GCVE-0-2024-21909)

Vulnerability from cvelistv5 – Published: 2024-01-03 15:41 – Updated: 2025-11-28 22:23

Title

Denial of service in CBOR library

Summary

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

VulnCheck

References

URL

Tags

	https://github.com/peteroupc/CBOR/security/adviso…	vendor-advisory
	https://github.com/peteroupc/CBOR/commit/b4117dbb…	patch
	https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1	related
	https://github.com/advisories/GHSA-6r92-cgxc-r5fg	third-party-advisory
	https://vulncheck.com/advisories/vc-advisory-GHSA…	third-party-advisory

Impacted products

	Vendor	Product	Version
			Affected: 4.0.0 , < 4.5.1 (semver 2.0.0)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.565Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-21909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-09T23:31:17.137288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:43:33.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://nuget.org/packages",
          "defaultStatus": "unaffected",
          "packageName": "PeterO.Cbor",
          "versions": [
            {
              "lessThan": "4.5.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver 2.0.0"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*",
                  "versionEndExcluding": "4.5.1",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\u003cbr\u003e"
            }
          ],
          "value": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-28T22:23:55.376Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Denial of service in CBOR library",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-21909",
    "datePublished": "2024-01-03T15:41:57.739Z",
    "dateReserved": "2024-01-03T14:21:17.583Z",
    "dateUpdated": "2025-11-28T22:23:55.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*\", \"versionStartIncluding\": \"4.0.0\", \"versionEndExcluding\": \"4.5.1\", \"matchCriteriaId\": \"1ACE4764-C56D-427B-99DA-52922CA6C062\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \\nservice vulnerability. An attacker may trigger the denial of service \\ncondition by providing crafted data to the DecodeFromBytes or other \\ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \\nlibrary, an unauthenticated and remote attacker may be able to cause the\\n denial of service condition.\\n\"}, {\"lang\": \"es\", \"value\": \"Las versiones de PeterO.Cbor 4.0.0 a 4.5.0 son vulnerables a una vulnerabilidad de denegaci\\u00f3n de servicio. Un atacante puede desencadenar la condici\\u00f3n de denegaci\\u00f3n de servicio proporcionando datos manipulados a DecodeFromBytes u otros mecanismos de decodificaci\\u00f3n en PeterO.Cbor. Dependiendo del uso de la biblioteca, un atacante remoto y no autenticado puede provocar la condici\\u00f3n de denegaci\\u00f3n de servicio.\"}]",
      "id": "CVE-2024-21909",
      "lastModified": "2024-11-21T08:55:15.167",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-01-03T16:15:09.003",
      "references": "[{\"url\": \"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\", \"source\": \"disclosure@vulncheck.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "disclosure@vulncheck.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"disclosure@vulncheck.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-407\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-407\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-21909\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2024-01-03T16:15:09.003\",\"lastModified\":\"2025-11-28T23:15:48.140\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \\nservice vulnerability. An attacker may trigger the denial of service \\ncondition by providing crafted data to the DecodeFromBytes or other \\ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \\nlibrary, an unauthenticated and remote attacker may be able to cause the\\n denial of service condition.\"},{\"lang\":\"es\",\"value\":\"Las versiones de PeterO.Cbor 4.0.0 a 4.5.0 son vulnerables a una vulnerabilidad de denegaci\u00f3n de servicio. Un atacante puede desencadenar la condici\u00f3n de denegaci\u00f3n de servicio proporcionando datos manipulados a DecodeFromBytes u otros mecanismos de decodificaci\u00f3n en PeterO.Cbor. Dependiendo del uso de la biblioteca, un atacante remoto y no autenticado puede provocar la condici\u00f3n de denegaci\u00f3n de servicio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-407\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-407\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.5.1\",\"matchCriteriaId\":\"1ACE4764-C56D-427B-99DA-52922CA6C062\"}]}]}],\"references\":[{\"url\":\"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\", \"tags\": [\"related\", \"x_transferred\"]}, {\"url\": \"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:35:34.565Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-21909\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-09T23:31:17.137288Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-09T23:31:19.029Z\"}}], \"cna\": {\"title\": \"Denial of service in CBOR library\", \"source\": {\"discovery\": \"INTERNAL\"}, \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.5.1\", \"versionType\": \"semver 2.0.0\"}], \"packageName\": \"PeterO.Cbor\", \"collectionURL\": \"https://nuget.org/packages\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/advisories/GHSA-6r92-cgxc-r5fg\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \\nservice vulnerability. An attacker may trigger the denial of service \\ncondition by providing crafted data to the DecodeFromBytes or other \\ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \\nlibrary, an unauthenticated and remote attacker may be able to cause the\\n denial of service condition.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \\nservice vulnerability. An attacker may trigger the denial of service \\ncondition by providing crafted data to the DecodeFromBytes or other \\ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \\nlibrary, an unauthenticated and remote attacker may be able to cause the\\n denial of service condition.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-407\", \"description\": \"CWE-407 Inefficient Algorithmic Complexity\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.1\", \"versionStartIncluding\": \"4.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2025-11-28T22:23:55.376Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-21909\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-28T22:23:55.376Z\", \"dateReserved\": \"2024-01-03T14:21:17.583Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2024-01-03T15:41:57.739Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GSD-2024-21909

Vulnerability from gsd - Updated: 2024-01-04 06:02

Details

Aliases

CVE-2024-21909

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-21909"
      ],
      "details": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n",
      "id": "GSD-2024-21909",
      "modified": "2024-01-04T06:02:16.115610Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "disclosure@vulncheck.com",
        "ID": "CVE-2024-21909",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-407",
                "lang": "eng",
                "value": "CWE-407 Inefficient Algorithmic Complexity"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg",
            "refsource": "MISC",
            "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "name": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95",
            "refsource": "MISC",
            "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
          },
          {
            "name": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1",
            "refsource": "MISC",
            "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
          },
          {
            "name": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg",
            "refsource": "MISC",
            "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "name": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg",
            "refsource": "MISC",
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
          }
        ]
      },
      "source": {
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*",
                    "matchCriteriaId": "1ACE4764-C56D-427B-99DA-52922CA6C062",
                    "versionEndExcluding": "4.5.1",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n"
          },
          {
            "lang": "es",
            "value": "Las versiones de PeterO.Cbor 4.0.0 a 4.5.0 son vulnerables a una vulnerabilidad de denegaci\u00f3n de servicio. Un atacante puede desencadenar la condici\u00f3n de denegaci\u00f3n de servicio proporcionando datos manipulados a DecodeFromBytes u otros mecanismos de decodificaci\u00f3n en PeterO.Cbor. Dependiendo del uso de la biblioteca, un atacante remoto y no autenticado puede provocar la condici\u00f3n de denegaci\u00f3n de servicio."
          }
        ],
        "id": "CVE-2024-21909",
        "lastModified": "2024-02-08T02:15:40.883",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-03T16:15:09.003",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
          },
          {
            "source": "disclosure@vulncheck.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-407"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-407"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

GHSA-6R92-CGXC-R5FG

Vulnerability from github – Published: 2022-01-21 23:35 – Updated: 2024-01-03 22:29

Summary

Denial of service in CBOR library

Details

Impact

Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to DecodeFromBytes or other CBOR decoding mechanisms in this library.

Affected versions include versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

Patches

This issue has been fixed in version 4.5.1. Users should use the latest version of this library. (The latest version is not necessarily 4.5.1. Check the NuGet page to see the latest version's version number.)

Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps. An input that decodes to a single CBOR object is not capable of containing a CBOR map if—

it begins with a byte other than 0x80 through 0xDF, or
it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

For more information

If you have any questions or comments about this advisory: * Open an issue in the CBOR repository.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "PeterO.Cbor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-18T22:57:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nDue to this library\u0027s use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.\n\nAffected versions _include_ versions 4.0.0 through 4.5.0.\n\nThis vulnerability was privately reported to me.\n\n### Patches\nThis issue has been fixed in version 4.5.1.  Users should use the latest version of this library. (The latest version is not necessarily 4.5.1.  Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version\u0027s version number.)\n\n### Workarounds\n\nAgain, users should use the latest version of this library.\n\nIn the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if\u0026mdash;\n\n- it begins with a byte other than 0x80 through 0xDF, or\n- it does not contain a byte in the range 0xa0 through 0xBF.\n\nSuch an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).\n",
  "id": "GHSA-6r92-cgxc-r5fg",
  "modified": "2024-01-03T22:29:30Z",
  "published": "2022-01-21T23:35:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/peteroupc/CBOR"
    },
    {
      "type": "WEB",
      "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Denial of service in CBOR library"
}

FKIE_CVE-2024-21909

Vulnerability from fkie_nvd - Published: 2024-01-03 16:15 - Updated: 2025-11-28 23:15

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
disclosure@vulncheck.com	https://github.com/advisories/GHSA-6r92-cgxc-r5fg	Third Party Advisory
disclosure@vulncheck.com	https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95	Patch
disclosure@vulncheck.com	https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1	Release Notes
disclosure@vulncheck.com	https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg	Third Party Advisory
disclosure@vulncheck.com	https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-6r92-cgxc-r5fg	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg	Third Party Advisory

Impacted products

	Vendor	Product	Version
	peteroupc	cbor	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*",
              "matchCriteriaId": "1ACE4764-C56D-427B-99DA-52922CA6C062",
              "versionEndExcluding": "4.5.1",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition."
    },
    {
      "lang": "es",
      "value": "Las versiones de PeterO.Cbor 4.0.0 a 4.5.0 son vulnerables a una vulnerabilidad de denegaci\u00f3n de servicio. Un atacante puede desencadenar la condici\u00f3n de denegaci\u00f3n de servicio proporcionando datos manipulados a DecodeFromBytes u otros mecanismos de decodificaci\u00f3n en PeterO.Cbor. Dependiendo del uso de la biblioteca, un atacante remoto y no autenticado puede provocar la condici\u00f3n de denegaci\u00f3n de servicio."
    }
  ],
  "id": "CVE-2024-21909",
  "lastModified": "2025-11-28T23:15:48.140",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-01-03T16:15:09.003",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-21909 (GCVE-0-2024-21909)

GSD-2024-21909

GHSA-6R92-CGXC-R5FG

Impact

Patches

Workarounds

For more information

FKIE_CVE-2024-21909

Tags

Sightings

Nomenclature