Buffer Overflow Affecting abseil/abseil-cpp package, versions [,20250127.rc1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-ABSEILABSEILCPP-8744647
- published23 Feb 2025
- disclosed21 Feb 2025
- creditUnknown
Introduced: 21 Feb 2025
NewCVE-2025-0838 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade abseil/abseil-cpp to version 20250127.rc1 or higher.
Overview
Affected versions of this package are vulnerable to Buffer Overflow. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. An attacker could pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write.