CVE-2023-39914

moderate-risk
Published 2023-09-13

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Do I need to act?

-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Bcder

Affected Vendors

Nlnetlabs

References (2)

Vendor Advisory https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
Vendor Advisory https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
32
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal