CVE-2021-4070CWE-193

Off-by-one Error in v2fly/v2ray-core

Medium · published February 23, 2022

CVSS v3.0
5.9
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

⚠️ Watch out for those pesky off-by-one errors! In the v2ray-core GitHub repository, a small mistake sneaks into the code that could lead to unexpected behaviors. 🔍 Think of it like a bakery recipe calling for 10 ounces of flour instead of 9 — that one ounce can cause the cake to collapse or come out all wrong! This off-by-one error could lead to subtle bugs slipping through the cracks in your application. While this vulnerability is classified as medium risk, an attacker could exploit this flaw to cause destabilizing effects in applications that rely on this library, potentially opening the door to further issues down the line. It’s a classic case of a small oversight leading to a larger problem!

Put simply

Think of it like a bakery recipe calling for 10 ounces of flour instead of 9 — that one ounce can cause the cake to collapse or come out all wrong! This off-by-one error could lead to subtle bugs slipping through the cracks in your application. The off-by-one error in v2ray-core prior to version 4.44.0 can result in incorrect memory handling, which could lead to unexpected behavior or crashes in software that utilizes this component.

What to do

While this vulnerability is classified as medium risk, an attacker could exploit this flaw to cause destabilizing effects in applications that rely on this library, potentially opening the door to further issues down the line. It’s a classic case of a small oversight leading to a larger problem! To protect your applications, make sure to upgrade v2ray-core to version 4.44.0 or later as soon as possible. Regularly check your dependencies and consider implementing automated updates to catch these issues early! You've got this! With these steps, you'll keep your code base safe and sound. 🛡️

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00858 · 58.0th percentile
Weakness
CWE-193 · Off-by-one Error
Published
2022-02-23T19:50Z
EPSS history
Timeline
  • 23 FEB 19:50Z
    Off-by-one Error in v2fly/v2ray-core
    cvelistv5