High severity7.5NVD Advisory· Published Aug 9, 2022· Updated Jun 17, 2026

CVE-2022-35724

Description

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
apache-avrocrates.io	< 0.14.0	0.14.0

Affected products

Apache/Avro
cpe:2.3:a:apache:avro:*:*:*:*:*:rust:*:*
Range: <0.14.0
ghsa-coords
pkg:cargo/apache-avro
Range: < 0.14.0
Apache/Apachecpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-v456-chpw-6mmwghsaADVISORY
lists.apache.org/thread/771z1nwrpkn1ovmyfb2fm65mchdxgy7pnvdMailing ListVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-35724ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000