Gmrtd
Monthly
gmrtd library versions prior to 0.17.2 fail to validate TLV (Tag-Length-Value) data lengths, allowing attackers to specify values up to 4GB that trigger excessive memory allocation and CPU consumption. Applications using gmrtd to parse travel documents from NFC devices or external APIs are vulnerable to denial of service attacks, particularly on resource-constrained environments like mobile devices. A patch is available in version 0.17.2 and later.
gmrtd library versions prior to 0.17.2 fail to validate TLV (Tag-Length-Value) data lengths, allowing attackers to specify values up to 4GB that trigger excessive memory allocation and CPU consumption. Applications using gmrtd to parse travel documents from NFC devices or external APIs are vulnerable to denial of service attacks, particularly on resource-constrained environments like mobile devices. A patch is available in version 0.17.2 and later.