PT-2026-104124 · Bc-Csharp · Bc-Csharp
CVSS v4.0
8.7
عالية
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
bc-csharp versions prior to 2.7.0
Description
Remote unauthenticated attackers can cause a denial of service through memory exhaustion by providing a specially crafted HSS public key and signature. The issue occurs because the level count
L read during the parsing of an HSS public key in the HssPublicKeyParameters and HssSignature code is not validated against the RFC 8554 maximum limit of 8. Consequently, the signature parsing process allocates an array of L - 1 entries before processing further data, which can lead to a single verification committing up to 17 GB of memory or triggering an OutOfMemoryException.Recommendations
Update bc-csharp to version 2.7.0 or later.
استغلال
إصلاح
DoS
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Bc-Csharp