CVE-2023-39410

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Sep 29, 2023
Updated: Jun 21, 2024
CWE ID 502

Summary

CVE-2023-39410 is a vulnerability affecting Java applications using Apache Avro Java SDK versions up to 1.11.2. The issue involves memory consumption during data deserialization of untrusted or corrupted data, potentially resulting in an out-of-memory condition on the system. By consuming more memory than allocated, an attacker could exploit this vulnerability and cause a denial-of-service or even execute arbitrary code. To mitigate this risk, users are advised to update their Apache Avro Java SDK to version 1.11.3, which includes the necessary patch to resolve this issue.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Apache Avro

Affected Vendors

  • Apache Software Foundation