GitHub Advisoryadvisory · SwiftURL, PyPI

GHSA-5c9c-6x87-f9vm zstd vulnerable to buffer overrun

HIGH Published 2023-03-31 Modified 2026-02-27 Official page ↗
Aliases
CVE-2022-4899
Ecosystem
SwiftURL, PyPI
Packages
github.com/facebook/zstd, zstd
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-06-06

Affected packages

• SwiftURL github.com/facebook/zstd: < 1.5.4 → fixed in 1.5.4 • PyPI zstd: < 1.5.4.0 → fixed in 1.5.4.0

Description

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.

Related

Alias · CVE (1)

  • CVE-2022-4899 A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References