id: PYSEC-2022-43180
published: "2022-08-09T07:15:07.443Z"
modified: "2024-11-21T07:12:26.917Z"
aliases:
- CVE-2022-36124
details: It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
affected:
- package:
    name: avro
    ecosystem: PyPI
    purl: pkg:pypi/avro
references:
- type: ADVISORY
  url: https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H