{"schemaVersion":3,"id":"CVE-2022-35724","aliases":["GHSA-v456-chpw-6mmw"],"status":"published","duplicateOf":null,"title":null,"description":"It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.","dates":{"published":"2022-08-09T06:50:24.000Z","modified":"2024-08-03T09:44:21.667Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0177,"percentile":0.77808,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.038000000000000186,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01732},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0177,"percentile":0.77808}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01732,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0177,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0177,"percentile":0.77808}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"},{"id":"CWE-835","name":"Loop with Unreachable Exit Condition ('Infinite Loop')","description":"The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/835.html"}],"affected":[{"vendor":"apache software foundation","product":"apache avro","name":"Apache Avro","label":"apache avro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 0.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 0.14.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_avro"},{"vendor":"apache","product":"avro","name":"avro","label":"avro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0","eol":null,"hubHref":"/vendor/apache/avro"},{"vendor":"Crates.Io","product":"apache-avro","name":"apache-avro","label":"apache-avro","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/apache-avro","purlType":"cargo","versions":[{"text":"< 0.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.14.0","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/771z1nwrpkn1ovmyfb2fm65mchdxgy7p","label":"lists.apache.org/thread/771z1nwrpkn1ovmyfb2fm65mchdxgy7p","hostname":"lists.apache.org","tags":["X Refsource MISC","WEB","Mailing List","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35724","label":"nvd.nist.gov/vuln/detail/CVE-2022-35724","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/a0x8o/avro","label":"github.com/a0x8o/avro","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-08-09T06:50:24.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T09:44:21.667Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:34:54.190Z","stale":false,"partial":false}}