CVE-2023-52266 Use after free in n/a
A use-after-free vulnerability in the ehttp library allows attackers to cause denial of service or potentially execute code by triggering rapid connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-52266?
CVE-2023-52266 is a high-severity use after free vulnerability in n/a, published on 30 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigger this.
Weakness: CWE-416
Which versions are affected by CVE-2023-52266?
It affects 1 product.
Products include Hongliuliao Ehttp.
How do I fix CVE-2023-52266?
No fix has been published for CVE-2023-52266 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-52266 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52266 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5fq8-x84x-j269.