Erlang stdlib GHSA-8q4w-2chm-mvj2: Unbounded Integer Conversion DoS

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: stdlib: Denial-of-Service enabled by Unbounded Integer Conversion Vulnerability ID: GHSA-8q4w-2chm-mvj2 Severity: Moderate, CVSS Score 6.9 / 10 Vulnerability Type: Denial of Service (DoS) caused by Unbounded Integer Conversion Affected Components: URL port component in within (unlimited digit count in , ) Trigger Paths: - Rendering path: , , generate unpadded C buffers without limits on shrinking or truncation, occupying a single scheduler thread and causing slowness for large integers. - Parsing path: , , have a smaller impact, but operations on large integers may still stall the scheduler thread. Amplification Factor: An attacker does not need to transmit an enormous number; they only need to send a 1MB binary (e.g., , i.e., one digit, one decimal point, one exponent). A single stringification triggers the issue. Impact Scope Affected Packages: - OTP: Affected versions ; fixed in , , - stdlib (OTP): Affected versions ; fixed in , , Unaffected Versions: Versions prior to OTP 17.0 are not affected; for new OTP versions introduced after OTP 17.0, those not listed are not affected. Remediation Upgrade OTP to , , Upgrade stdlib to , , POC / Exploitation Code The page does not include POC code or an exploitation code block. Other Information CWE: CWE-20 (Improper Input Validation) Weakness: CWE-1284 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Reporters: maineche, Pulsenet, hacgp, josevalim, Whaleee, IngridAndin Acknowledgments: Eric Meadows-Johnson, Johan Månsson, Peer Ullrich, Jose Valim

Goal Reached Thanks to every supporter — we hit 100%!

Erlang stdlib GHSA-8q4w-2chm-mvj2: Unbounded Integer Conversion DoS

More from this source