CVE-2023-39410
Assigner: apache
Published: 2023-09-29T16:23:34.021Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Avro Java SDK
vendor: Apache Software Foundation
versions: lessThan: 1.11.3
status: affected
version: 0
versionType: semver
credits: type: finder
value: Adam Korczynski at ADA Logics Ltd
descriptions: supportingMedia: base64: no
type: text/html
value: <div>When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.</div><div><br></div><div>This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.</div><div><br></div>
value: When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.


metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: defect: AVRO-3819
discovery: EXTERNAL
title: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
x_generator: engine: Vulnogram 0.1.0-dev