CVE-2024-53984mediumCWE-401CWE-755

CVE-2024-53984: falha de média gravidade em nanopb

Nanopb does not release memory on error return when using PB_DECODE_DELIMITED

Publicada em

Seguir esta CVE+ Monitorar nanopb+ Monitorar nanopb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
nanopb · nanopb
CVEs relacionadas — nanopb

No mesmo produto, das mais perigosas para as menos.

CVE-2020-26243HIGHMemory leak in nanopbEPSS 2.7%CVE-2021-21401HIGHInvalid free() call in NanopbEPSS 1.8%