PT-2022-28161 · Unknown · Petero.Cbor
Published
2022-01-21
·
Updated
2025-11-28
·
CVE-2024-21909
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
PeterO.Cbor versions 4.0.0 through 4.5.0
Description
The issue is a denial of service vulnerability that can be triggered by providing crafted data to the
DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. The vulnerability is due to the library's use of an inefficient algorithm.Recommendations
For versions 4.0.0 through 4.5.0, update to version 4.5.1 or the latest version available.
As a temporary workaround, consider checking the input data before passing it to the CBOR decoding mechanism to ensure it does not contain a CBOR map, by verifying that it does not start with a byte in the range 0x80 through 0xDF and does not contain a byte in the range 0xa0 through 0xBF.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Petero.Cbor