{"id":"CVE-2022-23435","aliases":["EUVD-2022-0751","GHSA-3mm4-w7v6-4rhv"],"status":"published","title":"android-gif-drawable vulerable to denial of service due to unrestricted comment length","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01192,"percentile":0.68201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2022-01-19T00:26:04Z","modified":"2026-10-28T10:25:25Z","fixes":[{"ecosystem":"Maven","package":"pl.droidsonroids.gif:android-gif-drawable","fixed_in":["1.2.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"pl.droidsonroids.gif:android-gif-drawable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24"}]}]},{"source":"osv","ecosystem":"Maven","package":"pl.droidsonroids.gif:android-gif-drawable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24"}]}],"versions":["1.0.10","1.0.11","1.0.12","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.16","1.1.17","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.14","1.2.15","1.2.16","1.2.17","1.2.18","1.2.19","1.2.2","1.2.20","1.2.21","1.2.22","1.2.23","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9"]}],"products":[{"vendor":"android-gif-drawable_project","product":"android-gif-drawable"}],"references":[{"url":"https://github.com/koral--/android-gif-drawable/commit/9f0f0c89e6fa38548163771feeb4bde84b828887","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/koral--/android-gif-drawable/compare/v1.2.23...v1.2.24","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23435","tags":["advisory"]},{"url":"https://github.com/koral--/android-gif-drawable/issues/792#issuecomment-1048850678","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3mm4-w7v6-4rhv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23435.json","tags":["advisory"]},{"url":"https://github.com/koral--/android-gif-drawable","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23435","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-19T00:26:04Z","modified":"2024-08-03T03:43:45.217Z","updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-0751","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-19T00:26:04Z","modified":"2024-08-03T03:43:45Z","updated_at":"2026-11-03T03:25:51.181739Z"}],"ghsa":[{"id":"GHSA-3mm4-w7v6-4rhv","title":"android-gif-drawable vulerable to denial of service due to unrestricted comment length","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-20T00:01:54Z","modified":"2025-01-13T15:22:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2022-23435","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-19T01:15:09.747Z","modified":"2026-06-17T04:30:00.463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"GHSA-3mm4-w7v6-4rhv","title":"android-gif-drawable vulerable to denial of service due to unrestricted comment length","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-20T00:01:54Z","modified":"2025-01-13T15:42:05.679129Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"CVE-2022-23435","description":"decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.","status":"published","published":"2022-01-19T00:26:04Z","modified":"2026-10-28T10:25:25.01203427Z","updated_at":"2026-11-02T15:44:24.061177Z"}]}}