GitHub Advisoryadvisory · PyPI

GHSA-gfvq-mxw3-mfq3 asyncua vulnerable to denial of service via infinite loop

HIGH Published 2023-10-03 Modified 2023-10-04 Official page ↗
Aliases
CVE-2023-26151
Ecosystem
PyPI
Packages
asyncua
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2023-10-04

Affected packages

• PyPI asyncua: < 0.9.96 → fixed in 0.9.96

Description

Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.

Related

Alias · CVE (1)

  • CVE-2023-26151 Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References