GitHub Advisoryadvisory · crates.io

GHSA-wcm8-86x6-8mv3 Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

HIGH Published 2022-08-10 Modified 2026-05-19 Official page ↗
Aliases
CVE-2022-36124
Ecosystem
crates.io
Packages
apache-avro
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2022-08-30

Affected packages

• crates.io apache-avro: < 0.14.0 → fixed in 0.14.0

Description

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

Related

Alias · CVE (1)

  • CVE-2022-36124 It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References