CVE-2024-10838 | THREATINT

Description

An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.

Reserved 2024-11-05 | Published 2025-03-12 | Updated 2025-03-12 | Assigner eclipse

HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-191 Integer Underflow (Wrap or Wraparound)

Product status

Default status

unaffected

Any version before 0.10.5

affected

Credits

Robert Femmer reporter

References

github.com/...onedds/security/advisories/GHSA-6jj6-w25p-jc42

github.com/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5

gitlab.eclipse.org/security/cve-assignement/-/issues/46

cve.org (CVE-2024-10838)

nvd.nist.gov (CVE-2024-10838)

Download JSON