CVE-2024-23084
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Apfloat v1.10.1 was found to contain an ArrayIndexOutOfBoundsException in the add method of the DoubleCRTMath class. Note: multiple third parties dispute the existence of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
Risk Assessment
If the vulnerability is real, it could cause application crashes when processing arrays of incorrect sizes, potentially enabling a DoS attack. However, due to the dispute over its existence, the risk is uncertain.
Recommendation
It is recommended to verify the report with the security team and monitor official Apfloat updates. In the meantime, consider limiting the use of the vulnerable method in critical applications.
Other vulnerabilities in Apfloat
See all- CVE-2024-23086Critical
A potential stack overflow was discovered in Apfloat v1.10.1 in the modPow method of the DoubleModMath class. However, multiple third parties dispute the validity of this report, citing insufficient evidence for the vulnerability's existence.
- CVE-2024-23085High
A NullPointerException was discovered in Apfloat v1.10.1 in the scramble method of the DoubleScramble class. Multiple third parties dispute the validity of this report, suggesting it may result from using an insufficiently robust vulnerability identification tool.
Original NVD description (English source)
Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.