{"id":"CVE-2024-21526","state":"PUBLISHED","title":"All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible","description":"All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process crash.","publishedAt":"2024-07-10T05:00:04.671Z","updatedAt":"2024-08-01T22:27:34.836Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","source":"snyk"},"assigner":"snyk","products":["n/a speaker"],"affected":[{"vendor":"n/a","product":"speaker","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"semver"}]}],"references":["https://security.snyk.io/vuln/SNYK-JS-SPEAKER-6370676","https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c%23L48"],"weaknesses":["CWE-400","CWE-241"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/21xxx/CVE-2024-21526.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-21526","state":"PUBLISHED","datePublished":"2024-07-10T05:00:04.671Z","dateUpdated":"2024-08-01T22:27:34.836Z","assignerShortName":"snyk","assignerOrgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateReserved":"2023-12-22T12:33:20.122Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process crash."}],"affected":[{"vendor":"n/a","product":"speaker","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"semver"}]}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SPEAKER-6370676"},{"url":"https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c%23L48"}],"metrics":[{"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"Denial of Service (DoS)","lang":"en"}]}],"providerMetadata":{"shortName":"snyk","orgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateUpdated":"2024-07-10T05:00:04.671Z"},"credits":[{"value":"Alessio Della Libera","lang":"en"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"tootallnate","product":"node-speaker","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"*","versionType":"custom"}],"cpes":["cpe:2.3:a:tootallnate:node-speaker:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-10T14:14:43.862303Z","id":"CVE-2024-21526","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-241","type":"CWE","lang":"en","description":"CWE-241 Improper Handling of Unexpected Data Type"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-10T14:18:37.442Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SPEAKER-6370676","tags":["x_transferred"]},{"url":"https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c%23L48","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:27:34.836Z"}}]}}}