CVE-2022-36125highCWE-190CWE-20

CVE-2022-36125: high-severity vulnerability in Apache Avro

Integer overflow when reading corrupted .avro file in Avro Rust SDK

Published · Updated

Follow this CVE+ Monitor Apache Avro+ Monitor apache-avro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.6%
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache Avro
Related CVEs — Apache Avro

In the same product, most dangerous first.

CVE-2021-43045—Possible DOS vulnerabilities in C# Avro SDKEPSS 3.1%CVE-2022-35724—Denial of service while reading data in Avro Rust SDKEPSS 1.8%CVE-2022-36124HIGHMemory overconsumption in Avro Rust SDKEPSS 1.6%