ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
oss-securitypublished ()ingested 1
Part of a story covered by 3 sources: “rosbridge_library Protocol.incoming() quadratic CPU cost disclosed on oss-security; follow-ups flag uncoordinated disclosure” — merged summary and timeline →

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

lowVulnerabilityimportance 25
AI summary · glm-5.3

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

  • Quadratic CPU cost in Protocol.incoming() JSON fallback enables DoS
  • Present on current ros2 branch and not fixed by PR #1199
  • Classified as CWE-407 inefficient algorithmic complexity
Read the original
Tagsrosbridgerosdenial-of-servicealgorithmic-complexitycwe-407
Full article

Posted by Evgenios Gkritsis on Sep 14 Hello, I am reporting an algorithmic-complexity defect in rosbridge_library.protocol.Protocol.incoming() in rosbridge_suite. It is present in the current code on the ros2 branch and was not removed by PR #1199. Affected: Product: rosbridge_suite (rosbridge_library) Component: Protocol.incoming() JSON fallback Versions: current ros2 branch; present since the fallback was introduced CWE: CWE-407 (Inefficient Algorithmic Complexity) / CWE-1050...

This source does not provide full text. Read it at seclists.org.