Skip to main content

Avro CVE-2022-36125

HIGH
Improper Input Validation (CWE-20)
2022-08-09 security@apache.org
Apache Denial Of Service Avro
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 09, 2022 - 07:15 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 18 cargo packages depend on apache-avro (14 direct, 4 indirect)

Ecosystem-wide dependent count for version 0.14.0.

DescriptionNVD

It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

AnalysisAI

It is possible to crash (panic) an application by providing a corrupted data to be read.14.0 (previously known as avro-rs). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. It is possible to crash (panic) an application by providing a corrupted data to be read.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. Affected products include: Apache Avro. Version information: prior to 0.14.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Avro

View all
CVE-2023-37475 HIGH POC
7.5 Jul 17

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. Rated high severity (CVSS 7.5),

CVE-2024-47561 CRITICAL
9.2 Oct 03

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.

CVE-2022-36124 HIGH
7.5 Aug 09

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the syste
CVE-2023-39410 HIGH
7.5 Sep 29

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constra
CVE-2022-35724 HIGH
7.5 Aug 09

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU.14.0 (previou
CVE-2025-33042 HIGH
7.3 Feb 13

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2022-36125 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy