What’s Vulnerable › Vulnerabilities

CVE-2024-3508: Bzip2: compressed content bomb leads to denial of service of bombastic api

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-25 · updated 2026-06-17
• Weakness: CWE-400

Description

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

Affected products

• Red Hat Trusted Profile Analyzer: all versions

References

• https://access.redhat.com/security/cve/CVE-2024-3508
• https://bugzilla.redhat.com/show_bug.cgi?id=2274109
• https://access.redhat.com/security/cve/CVE-2024-3508
• https://bugzilla.redhat.com/show_bug.cgi?id=2274109

Get alerted when CVE-2024-3508 or the next vulnerability affects your stack