CVE-2024-23684

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-23684
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23684.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23684
Aliases
Published
2024-01-19T20:59:02.723Z
Modified
2026-07-22T03:15:31.328855Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
upokecenter CBOR Denial of Service
Details

Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23684.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-407"
    ]
}
References

Affected packages

Git / github.com/peteroupc/cbor

Affected ranges

Type
GIT
Repo
https://github.com/peteroupc/cbor
Events
Introduced
a06712788d5af3bb75a214d74238525b5a62baaa
Fixed
f74930528be1d86ccfd431e21629bfba7a4be20d
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.5.1"
        }
    ],
    "cpe": "cpe:2.3:a:peteroupc:cbor:*:*:*:*:*:.net:*:*"
}
Type
GIT
Repo
https://github.com/peteroupc/cbor-java
Events
Introduced
6080a9e6552afdc4b7cafcf83c964442339ec424
Fixed
626acf4abee0225a11b45e1c3e28502c75573b15
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.5.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v4.*
v4.0.0
v4.0.1
v4.1.0
v4.1.3
v4.2.0
v4.3.0
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.5

Database specific

vanir_signatures_modified 
"2026-07-22T03:15:31Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/com/upokecenter/cbor/CBORObject.java"
        },
        "id": "CVE-2024-23684-9184b715",
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "245892753497545230889079758148533917264",
                "315323011616642422117914166067564514355",
                "331648540739023347659894369769830188336",
                "108298526331740189779353926158578726047",
                "93474761964609928850723666233524642066"
            ]
        },
        "source": "https://github.com/peteroupc/cbor-java/commit/626acf4abee0225a11b45e1c3e28502c75573b15"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/com/upokecenter/cbor/CBORObject.java",
            "function": "MapCompare"
        },
        "id": "CVE-2024-23684-ef607bf4",
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "function_hash": "295978138187162415375781255315036520609",
            "length": 1001.0
        },
        "source": "https://github.com/peteroupc/cbor-java/commit/626acf4abee0225a11b45e1c3e28502c75573b15"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23684.json"