CVE-2023-48230 is a critical buffer underrun vulnerability affecting Cap'n Proto versions 1.0 and 1.0.1 when using the KJ HTTP library with WebSocket compression enabled. A remote attacker can trigger a crash, leading to a denial-of-service, and potentially remote code execution, though the latter is considered less likely due to the non-attacker-controlled write. Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and requires no user interaction, making it easily exploitable over the network. The primary impact is denial-of-service, but the possibility of remote code execution cannot be entirely ruled out. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability. The maintainers suspect only the Cloudflare Workers Runtime is affected, and the issue is resolved in Cap'n Proto 1.0.1.1.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0CPE matchmatch criteria | cpe:2.3:a:capnproto:capnproto:1.0.0:*:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:capnproto:capnproto:1.0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.