CVE-2023-28507 - CVE House
Back to Database
Status published Unknown CVE-2023-28507

Memory exhaustion in LZ4 decompression in UniRPC daemon

Vulnerability Description

Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustion issue, where a decompression routine will allocate increasing amounts of memory until all system memory is exhausted and the forked process crashes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28507

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ron Bowes

References

More from Rocket Software

View All →
CVE-2023-28509
Weak encryption in UniRPC protocol
Unknown 0
CVE-2023-28508
Heap corruption in UniRPC service
Unknown 0
CVE-2023-28506
Stack buffer overflow in UniRPC service
Unknown 0
CVE-2023-28505
Buffer overflow in UniRPC library function
Unknown 0
CVE-2023-28504
Stack buffer overflow in UniRPC library function
Unknown 0

Affected Vendor

Rocket Software

View all reports →

Affected Software

UniData, UniVerse
Vulnerable Versions:
0

Timeline

Official Publish: March 29th, 2023
Last Modified: February 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact