CVE-2020-8244: Remote Memory Exposure in bl

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-08-30 · updated 2026-06-17
Weakness: CWE-126

Description

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Affected products

Bufferlist Project Bufferlist: before 1.2.3; from 2.0.0 before 2.2.1; from 3.0.0 before 3.0.1; from 4.0.0 before 4.0.3 — fixed in 1.2.3, 2.2.1, 3.0.1, 4.0.3
Debian Linux: 9.0
Npm Bl: before 1.2.3; from 2.0.0 before 2.2.1; from 3.0.0 before 3.0.1; from 4.0.0 before 4.0.3; 3.0.0 — fixed in 1.2.3, 2.2.1, 3.0.1, 4.0.3

How to fix

Upgrade to a fixed version: Bufferlist Project Bufferlist 1.2.3, 2.2.1, 3.0.1, 4.0.3; Npm Bl 1.2.3, 2.2.1, 3.0.1, 4.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8244 or the next vulnerability affects your stack