Not rated
CVE-2022-36125 It is possible to crash (panic) an application by providing a corrupted data to be read
Description
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Avro 0.14 | earliest → < 0.14.0 | 0.14.0 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Avro
The 4 CVEs of Apache Avro →
CVE-2022-36124
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the…
Not rated
CVE-2022-35724
It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU
Not rated
CVE-2021-43045
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a…
Not rated