GHSA-vrcx-gx3g-j3h8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vrcx-gx3g-j3h8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-vrcx-gx3g-j3h8/GHSA-vrcx-gx3g-j3h8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vrcx-gx3g-j3h8
- Aliases
-
- CVE-2024-46488
- Published
- 2024-09-25T18:31:21Z
- Modified
- 2024-10-02T21:22:41.575859Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Heap-based Buffer Overflow in sqlite-vec
- Details
-
sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npytokennext function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2024-46488
- https://github.com/VulnSphere/LLMVulnSphere/blob/main/VectorDB/sqlite-vec/OOBR_2.md
- https://github.com/advisories/GHSA-vrcx-gx3g-j3h8
- https://github.com/asg017/sqlite-vec
- https://github.com/asg017/sqlite-vec/releases/tag/v0.1.3
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite-vec/CVE-2024-46488.yml
Affected packages
PyPI / sqlite-vec
Package
- Name
- sqlite-vec
- View open source insights on deps.dev
- Purl
- pkg:pypi/sqlite-vec
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.1.3
Affected versions
0.*
0.0.1a3
0.0.1a7
0.0.1a8
0.0.1a9
0.0.1a10
0.0.1a12
0.0.1a13
0.0.1a14
0.0.1a16
0.0.1a17
0.0.1a18
0.0.1a19
0.0.1a20
0.0.1a21
0.0.1a22
0.0.1a23
0.0.1a24
0.0.1a25
0.0.1a26
0.0.1a27
0.0.1a28
0.0.1a29
0.0.1a30
0.0.1a31
0.0.1a32
0.0.1a33
0.0.1a34
0.0.1a35
0.0.1a36
0.0.1a37
0.1.0a1
0.1.0
0.1.1a2
0.1.1a3
0.1.1
0.1.2a1
0.1.2a2
0.1.2a4
0.1.2a5
0.1.2a6
0.1.2a7
0.1.2a9
0.1.2a10
0.1.2
0.1.3a1
0.1.3a2
0.1.3a3
npm / sqlite-vec
Package
- Name
- sqlite-vec
- View open source insights on deps.dev
- Purl
- pkg:npm/sqlite-vec
RubyGems / sqlite-vec
Package
- Name
- sqlite-vec
- Purl
- pkg:gem/sqlite-vec
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.1.3
Affected versions
0.*
0.0.1.alpha.3
0.0.1.alpha.7
0.0.1.alpha.8
0.0.1.alpha.9
0.0.1.alpha.10
0.0.1.alpha.12
0.0.1.alpha.13
0.0.1.alpha.14
0.0.1.alpha.16
0.0.1.alpha.17
0.0.1.alpha.18
0.0.1.alpha.19
0.0.1.alpha.20
0.0.1.alpha.21
0.0.1.alpha.22
0.0.1.alpha.23
0.0.1.alpha.24
0.0.1.alpha.25
0.0.1.alpha.26
0.0.1.alpha.27
0.0.1.alpha.28
0.0.1.alpha.29
0.0.1.alpha.30
0.0.1.alpha.31
0.0.1.alpha.32
0.0.1.alpha.33
0.0.1.alpha.34
0.0.1.alpha.35
0.0.1.alpha.36
0.0.1.alpha.37
0.1.0.alpha.1
0.1.0
0.1.1.alpha.1
0.1.1.alpha.2
0.1.1.alpha.3
0.1.1
0.1.2.alpha.1
0.1.2.alpha.2
0.1.2.alpha.4
0.1.2.alpha.5
0.1.2.alpha.6
0.1.2.alpha.7
0.1.2.alpha.9
0.1.2.alpha.10
0.1.2
0.1.3.alpha.1
0.1.3.alpha.2
0.1.3.alpha.3
crates.io / sqlite-vec
Package
- Name
- sqlite-vec
- View open source insights on deps.dev
- Purl
- pkg:cargo/sqlite-vec