{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-05T19:15:58.472","vulnerabilities":[{"cve":{"id":"CVE-2022-36078","sourceIdentifier":"security-advisories@github.com","published":"2022-09-02T13:15:08.930","lastModified":"2026-06-17T04:52:52.237","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program. When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice."},{"lang":"es","value":"Binary proporciona codificación/decodificación en Borsh y otros formatos. La vulnerabilidad es un fallo de asignación de memoria que puede ser explotada para asignar fragmentos en la memoria con un valor de tamaño (arbitrario) excesivo, que puede agotar la memoria disponible o bloquear todo el programa. Cuando es usada \"github.com/gagliardetto/binary\" para analizar datos no verificados (o de tipo incorrecto) procedentes de fuentes de entrada no confiables (por ejemplo, la cadena de bloques) en trozos, es posible asignar memoria con un tamaño excesivo. Cuando es usado el método \"dec.Decode(&amp;val)\" para parsear datos en una estructura que es o contiene trozos de valores, la longitud del trozo es leído previamente directamente de los propios datos sin ninguna comprobación del tamaño de los mismos, y luego es asignado un trozo. Esto podría conllevar a un desbordamiento y una asignación de memoria con un valor de tamaño excesivo. Los usuarios deberían actualizar a versiones \"v0.7.1\" o superiores. Una mitigación es no confiar en la función \"dec.Decode(&amp;val)\" para analizar los datos, sino usar un método personalizado \"UnmarshalWithDecoder()\" que lea y compruebe la longitud de cualquier slice"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gagliardetto","product":"binary","versions":[{"version":"< 0.7.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:42:32.400219Z","id":"CVE-2022-36078","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-1284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:binary_project:binary:*:*:*:*:*:go:*:*","versionEndExcluding":"0.7.1","matchCriteriaId":"A0A6D34C-F9B9-46CE-B80A-4B5C44DE6A71"}]}]}],"references":[{"url":"https://github.com/gagliardetto/binary/pull/7","source":"security-advisories@github.com","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/gagliardetto/binary/releases/tag/v0.7.1","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/gagliardetto/binary/security/advisories/GHSA-4p6f-m4f9-ch88","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/gagliardetto/binary/pull/7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/gagliardetto/binary/releases/tag/v0.7.1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/gagliardetto/binary/security/advisories/GHSA-4p6f-m4f9-ch88","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mitigation","Third Party Advisory"]}]}}]}