PT-2022-22951

CVE-2022-35724

Published

2022-08-09

Updated

2022-08-15

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Avro Rust SDK versions prior to 0.14.0

Description It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications.

Recommendations For versions prior to 0.14.0, update to apache-avro version 0.14.0 to address this issue. As a temporary workaround, consider restricting the input data to prevent endless loops until the update is applied.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-20: Improper Input Validation

Related identifiers

CVE-2022-35724