CVE-2022-36124

CVE-2022-36124: Memory overconsumption in Avro Rust SDK

Vendor Apache Software Foundation

Product Apache Avro

Weakness CWE-770 · Uncontrolled resource consumption

Published August 9, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

Key dates

02Disclosure timeline

August 9, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36124 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html

Related vulnerabilities

04Related CVE

CVE-2026-6948 Unbounded Memory Allocation in VQLResponse Result-Set Writer CVE-2020-36907 Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service CVE-2024-31881 IBM Db2 denial of service CVE-2026-44499 ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning CVE-2026-40608 Next AI Draw.io: Unbounded HTTP Body — Denial of Service