CVE-2024-3508 MEDIUM

CVE-2024-3508: Bzip2: compressed content bomb leads to denial of service of bombastic api

Vendor Red Hat
Product Red Hat Trusted Profile Analyzer
Weakness CWE-400
Published April 25, 2024
Last update November 20, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

Key dates

02Disclosure timeline

April 25, 2024 CVE published
November 20, 2025 Record updated