CVE-2024-13009 Affecting cassandra-reaper package, versions <3.8.0-r3


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-CASSANDRAREAPER-10109814
  • published9 May 2025
  • disclosed8 May 2025

Introduced: 8 May 2025

CVE-2024-13009  (opens in a new tab)

How to fix?

Upgrade Chainguard cassandra-reaper to version 3.8.0-r3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cassandra-reaper package and not the cassandra-reaper package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

CVSS Base Scores

version 3.1