CVE-2023-37475
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-37475 is a denial-of-service vulnerability affecting Hamba avro's Go lang implementation of the Avro codec specification. A maliciously crafted string input to `github.com/hamba/avro/v2.Unmarshal()` can cause an unrecoverable "out of memory" error, consuming arbitrary amounts of memory and leading to application crashes. This issue arises because avro utilizes a portion of the input to `Unmarshal()` to determine the size when creating a new slice, making it susceptible to memory exhaustion attacks. The vulnerability has been mitigated by commit `b4a402f4`, which is part of release version `2.13.0`. Users are strongly advised to upgrade as soon as possible, with no known workarounds available.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions