CVE-2021-43045

Published: Jan 6, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.

Affected (1)

Products: Apache: Avro

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Avro	Before 1.11.0

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

http://www.openwall.com/lists/oss-security/2022/01/06/8

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/01/06/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.