CVE-2023-39410
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-39410 is a vulnerability affecting Java applications using Apache Avro Java SDK versions up to 1.11.2. The issue involves memory consumption during data deserialization of untrusted or corrupted data, potentially resulting in an out-of-memory condition on the system. By consuming more memory than allocated, an attacker could exploit this vulnerability and cause a denial-of-service or even execute arbitrary code. To mitigate this risk, users are advised to update their Apache Avro Java SDK to version 1.11.3, which includes the necessary patch to resolve this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Apache Avro
Affected Vendors
- Apache Software Foundation
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions