CVE-2015-2313 - CVE House
Back to Database
Status published High CVE-2015-2313

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when...

Vulnerability Description

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-2313

Credits & Attribution

No credits recorded in the NVD database.

References

More from capnproto

View All →
CVE-2023-48230
Cap'n Proto WebSocket message can cause crash
Medium 5.9
CVE-2022-46149
Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Medium 5.4
CVE-2017-7892
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to...
High 7.5
CVE-2015-2312
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows...
High 7.5
CVE-2015-2311
Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x...
Critical 9.8

Affected Vendor

Affected Software

capnproto
Vulnerable Versions:
0, 0.5.0.0, 0.5.1.0, 0.5.1.1

Timeline

Official Publish: August 9th, 2017
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.