{"id":"CVE-2024-23684","aliases":["EUVD-2024-0367","GHSA-fj2w-wfgv-mwq6","GHSA-hfj8-63c8-rmfw"],"status":"published","title":"upokecenter CBOR Denial of Service","description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0092,"percentile":0.60713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2022-01-21T23:21:48Z","modified":"2026-11-08T14:00:00Z","fixes":[{"ecosystem":"Maven","package":"com.upokecenter:cbor","fixed_in":["4.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.upokecenter:cbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.upokecenter:cbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}],"versions":["4.0.0","4.0.1","4.1.0","4.1.1","4.1.3","4.2.0","4.3.0","4.4.0","4.4.1","4.4.2","4.4.3","4.4.4","4.5"]}],"products":[{"vendor":"peteroupc","product":"cbor"}],"references":[{"url":"https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/advisories/GHSA-fj2w-wfgv-mwq6","tags":["vendor-advisory","third-party-advisory","x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23684","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hfj8-63c8-rmfw"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23684.json","tags":["advisory"]},{"url":"https://github.com/peteroupc/CBOR-Java","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23684","title":"upokecenter CBOR Denial of Service","description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"published","published":"2024-01-19T20:59:02.723Z","modified":"2026-11-08T14:00:00.715Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-407"],"updated_at":"2026-11-08T14:43:22.764053Z"}],"euvd":[{"id":"EUVD-2024-0367","description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"published","published":"2024-01-19T20:59:02Z","modified":"2026-11-08T14:00:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-08T15:13:10.25084Z"}],"ghsa":[{"id":"GHSA-fj2w-wfgv-mwq6","title":"Denial of service in CBOR library","description":"### Impact\nDue to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.  \n\nAffected versions _include_ versions 4.0.0 through 4.5.0.\n\nThis vulnerability was privately reported to me.\n\n### Patches\nThis issue has been fixed in version 4.5.1.  Users should use the latest version of this library.  (The latest version is not necessarily 4.5.1.  Check the README for [this library's repository](https://github.com/peteroupc/CBOR-Java) to see the latest version's version number.)\n\n### Workarounds\n\nAgain, users should use the latest version of this library.\n\nIn the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if\u0026mdash;\n\n- it begins with a byte other than 0x80 through 0xDF, or\n- it does not contain a byte in the range 0xa0 through 0xBF.\n\nSuch an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR-Java).","status":"published","published":"2022-01-21T23:21:48Z","modified":"2026-01-22T20:53:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:39:19.525691Z"},{"id":"GHSA-hfj8-63c8-rmfw","title":"Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"withdrawn","published":"2024-01-19T21:30:36Z","modified":"2026-01-22T20:53:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2024-23684","description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"published","published":"2024-01-19T21:15:10.387Z","modified":"2026-07-14T23:17:16.54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23684","title":"upokecenter CBOR Denial of Service","description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"published","published":"2024-01-19T20:59:02.723Z","modified":"2026-11-09T07:05:50.88350285Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-09T03:16:26.778234Z"},{"id":"GHSA-fj2w-wfgv-mwq6","title":"Denial of service in CBOR library","description":"### Impact\nDue to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.  \n\nAffected versions _include_ versions 4.0.0 through 4.5.0.\n\nThis vulnerability was privately reported to me.\n\n### Patches\nThis issue has been fixed in version 4.5.1.  Users should use the latest version of this library.  (The latest version is not necessarily 4.5.1.  Check the README for [this library's repository](https://github.com/peteroupc/CBOR-Java) to see the latest version's version number.)\n\n### Workarounds\n\nAgain, users should use the latest version of this library.\n\nIn the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if\u0026mdash;\n\n- it begins with a byte other than 0x80 through 0xDF, or\n- it does not contain a byte in the range 0xa0 through 0xBF.\n\nSuch an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR-Java).","status":"published","published":"2022-01-21T23:21:48Z","modified":"2026-07-08T06:53:02.886283685Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"GHSA-hfj8-63c8-rmfw","title":"Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","status":"withdrawn","published":"2024-01-19T21:30:36Z","modified":"2026-09-10T03:50:00.358623955Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}