CVE-2024-32035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32035
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-32035.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-32035
Aliases
Published
2024-04-15T19:59:59.530Z
Modified
2026-02-11T02:34:23.607054Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Memory Allocation with Excessive Size Value in SixLabors.ImageSharp
Details

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32035.json"
}
References

Affected packages

Git / github.com/sixlabors/imagesharp

Affected ranges

Type
GIT
Repo
https://github.com/sixlabors/imagesharp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f21d64188e59ae9464ff462056a5e29d8e618b27
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/sixlabors/imagesharp
Events
Introduced
6ec1692ee295923d9d40956befd4417d6735507b
Fixed
da5f09a42513489fe359578d81cec2f15ba588ba
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.4"
        }
    ]
}

Affected versions

v1.*
v1.0.3
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.1.2
v3.1.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-32035.json"