{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.upokecenter:cbor","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThan":"4.5.1","status":"affected","version":"4.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.upokecenter:cbor","product":"com.upokecenter:cbor","source":"OSV GHSA-fj2w-wfgv-mwq6","vendor":"","versions":[{"status":"affected","version":"4.0.0","versionType":"Maven"},{"status":"affected","version":"4.0.1","versionType":"Maven"},{"status":"affected","version":"4.1.0","versionType":"Maven"},{"status":"affected","version":"4.1.1","versionType":"Maven"},{"status":"affected","version":"4.1.3","versionType":"Maven"},{"status":"affected","version":"4.2.0","versionType":"Maven"},{"status":"affected","version":"4.3.0","versionType":"Maven"},{"status":"affected","version":"4.4.0","versionType":"Maven"},{"status":"affected","version":"4.4.1","versionType":"Maven"},{"status":"affected","version":"4.4.2","versionType":"Maven"},{"status":"affected","version":"4.4.3","versionType":"Maven"},{"status":"affected","version":"4.4.4","versionType":"Maven"},{"status":"affected","version":"4.5","versionType":"Maven"},{"events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}],"status":"unknown","version":"4.0.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23684","cwes":["CWE-407"],"description":"Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.","epss":{"date":"2026-11-08","percentile":0.60519,"score":0.0092},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794146400715,"publishedAt":1705697942723,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-fj2w-wfgv-mwq6"}],"remediation":[{"kind":"fix","source":"OSV GHSA-fj2w-wfgv-mwq6","text":"com.upokecenter:cbor (Maven): OSV reports a fixed version 4.5.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"}],"revision":"2da959761ddcd44b670d69964c1c456ed7dafe9c4794c699d8f4524cad55fa49","sources":[{"modifiedAt":1794146400715,"name":"CNA: VulnCheck","retrievedAt":1794146934747,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23684"},{"modifiedAt":1783493582886,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146935128,"url":"https://osv.dev/vulnerability/GHSA-fj2w-wfgv-mwq6"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150558379,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23684"}],"ssvc":{"assessedAt":1705790060958,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"upokecenter CBOR Denial of Service","updatedAt":1794150558379}