VULNERABILITY INTELLIGENCE

CVE-2020-8244

CVSS score6.5 MEDIUM

EPSS probability2.10%

CISA KEVNot currently listed

Published2020-08-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Description

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Weakness classification

CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read

Primary references

support@hackerone.com — Exploit, Patch, Third Party Advisory
support@hackerone.com — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory