PT-2025-14807 · Snowplow · Snowplow Collector

Published 2025-04-03 · Updated 2025-04-04 · CVE-2024-56528

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Snowplow Collector versions 3.x before 3.3.0

Description The issue involves sending very large payloads to the Collector, which can render it unresponsive to other requests, potentially leading to data loss.

Recommendations For Snowplow Collector versions 3.x before 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider setting up the Collector behind a reverse proxy that establishes payload limits to prevent oversized payloads from being sent.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-56528

Affected Products

Snowplow Collector

References · 7

• https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56528 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56528 · Vendor Advisory
• https://t.me/cvetracker/20746 · Telegram Post
• https://t.me/cvedetector/22044 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1907909632502149401 · Twitter Post
• https://twitter.com/CVEnew/status/1908072055754342845 · Twitter Post