CVE-2022-36125

High
|7.5
No Exploit

Plain English Summary

AI-powered analysis for quick understanding

An attacker can crash an application by sending it corrupted data when using the Apache Avro Rust SDK, which can disrupt services and lead to downtime. This vulnerability affects versions prior to 0.14.0, so users should upgrade to the latest version to protect against this issue.

Technical Description

It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
Confidentiality ImpactNone
Integrity ImpactNone
Availability ImpactHigh
ScopeUnchanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$2,053($1K-$5K)
Vendor Response
Grade FPatched in 1305 days

Quick Information

Published

Aug 9, 2022

over 3 years ago

Last Modified

Mar 6, 2026

about 1 month ago

Vendor

apache

Product

avro

Related Vulnerabilities

CVE-2025-66249Medium

This vulnerability allows an attacker to access files outside of the intended directory on an Apache Livy server, potentially exposing sensitive data. It can only be exploited if the server is configured with a non-default setting for local directory access, so users should upgrade to version 0.9.0 to protect against this risk.

CVE-2025-60012Medium

This vulnerability allows an attacker to access files they shouldn't be able to reach by sending specially crafted requests to Apache Livy's REST or JDBC interface. To exploit this, the attacker must already have access to these interfaces and be able to include specific Spark configuration values in their requests.

CVE-2026-25604Medium

An attacker could gain unauthorized access to different AWS instances by reusing SAML authentication responses from other instances, potentially bypassing access controls. This vulnerability occurs because the system does not verify the origin of the SAML response against the actual instance URL, so it's crucial to upgrade to version 9.22.0 of the provider if you're using AWS Auth Manager.

CVE-2025-69219High

This vulnerability allows an attacker with access to the database to run unauthorized code, effectively giving them the same permissions as the original creator of workflows in Airflow. While direct access to the database is uncommon and not recommended, upgrading to version 6.0.0 of the provider is essential to eliminate this risk.

CVE-2026-24713Critical

This vulnerability allows an attacker to send malicious input to Apache IoTDB, potentially leading to unauthorized access or manipulation of data. It affects versions 1.0.0 to 1.3.6 and 2.0.0 to 2.0.6, so users should upgrade to the latest versions to protect against this risk.