CVE-2024-56528

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-03 · updated 2026-06-17
Weakness: CWE-400

Description

This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the pipeline and would be potentially lost.

Affected products

Snowplow Stream Collector: from 3.0.0 before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: Snowplow Stream Collector 3.3.0. Check the vendor advisory for mitigations.

References

https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users

Get alerted when CVE-2024-56528 or the next vulnerability affects your stack