CVE-2024-37820

PingCAP TiDB nil pointer dereference

5.4 MediumFix available

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.38%Up 0.3 points since Jun 26, 2024

What each source reports

CVE List Score used 5.4

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Record: CVE-2024-37820
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2024-2219 5.4

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Record: EUVD-2024-2219
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9g6g-xqv5-8g5w 5.3

PingCAP TiDB nil pointer dereference

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Record: GHSA-9g6g-xqv5-8g5w
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-476
Updated: 2026-11-02

NVD 5.4

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Record: CVE-2024-37820
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-476
Updated: 2026-11-02

OSVGHSA-9g6g-xqv5-8g5w 5.3

PingCAP TiDB nil pointer dereference

A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.

Record: GHSA-9g6g-xqv5-8g5w
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-476
Updated: 2026-11-02

OSVGO-2024-3284 No score

PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb

PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/pingcap/tidb before v8.2.0.

Record: GO-2024-3284
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14567-1 No score

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14567-1
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/pingcap/tidb` Go	before 8.2.0	8.2.0
`github.com/pingcap/tidb` Go	All versions	None known
`govulncheck-vulndb` openSUSE:Tumbleweed From an advisory covering 21 CVEs	before 0.0.20241209T183251-1.1	0.0.20241209T183251-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-37820 is a medium vulnerability (CVSS 5.4) in github.com/pingcap/tidb, published June 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in github.com/pingcap/tidb 8.2.0.

References

Show 22 moreShow less