VULNERABILITY INTELLIGENCE

CVE-2024-3508

CVSS score4.3 MEDIUM
EPSS probability0.49%
CISA KEVNot currently listed
Published2024-04-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Description

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

Weakness classification

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references