CVE-2024-3508CWE-400

Bzip2: compressed content bomb leads to denial of service of bombastic api

Medium · published April 25, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00491 · 41.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-04-25T17:46Z
EPSS history
Timeline
  • 25 APR 17:46Z
    Bzip2: compressed content bomb leads to denial of service of bombastic api
    cvelistv5