CVE-2022-36124
Last modified
CVE-2022-36124 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). EPSS estimates a 1.28% chance of exploitation in the next 30 days.
Description
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Avro | < 0.14.0 |
References
- https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zoMailing List, Vendor Advisory
- https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zoMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-36124?
How severe is CVE-2022-36124?
How do I fix CVE-2022-36124?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-36118An issue was discovered in Blue Prism Enterprise 6.0 through…5.3
- CVE-2022-36119An issue was discovered in Blue Prism Enterprise 6.0 through…8.8
- CVE-2022-36120An issue was discovered in Blue Prism Enterprise 6.0 through…8.1
- CVE-2022-36121An issue was discovered in Blue Prism Enterprise 6.0 through…5.3
- CVE-2022-36122The Automox Agent before 40 on Windows incorrectly sets perm…7.8
- CVE-2022-36123The Linux kernel before 5.18.13 lacks a certain clear operat…7.8
- CVE-2022-36125It is possible to crash (panic) an application by providing …7.5
- CVE-2022-36126An issue was discovered in Inductive Automation Ignition bef…7.2
- CVE-2022-36127A vulnerability in Apache SkyWalking NodeJS Agent prior to 0…7.5
- CVE-2022-36129HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and …9.1
- CVE-2022-3613An issue has been discovered in GitLab CE/EE affecting all v…7.5
- CVE-2022-36130HashiCorp Boundary up to 0.10.1 did not properly perform dat…9.9
Are you affected by CVE-2022-36124?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST