CVE-2023-48230

Summary

CVE-2023-48230 is a vulnerability affecting Cap'n Proto versions 1.0 and 1.0.1 when using the KJ HTTP library with WebSocket compression enabled. A remote peer can cause a buffer underrun, resulting in a crash and enabling a denial-of-service attack. The bytes written out-of-bounds are a constant value `{ 0x00, 0x00, 0xFF, 0xFF }`, making remote code execution unlikely but not impossible. This issue primarily affects the Cloudflare Workers Runtime and appeared in Cap'n Proto 1.0. Cap'n Proto 1.0.1.1 is the fixed version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.