Description (CNA)
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| KeePass / KeePass | affected 2.35 through 2.61.1 |
CWE
CWE-789
References
- https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC
- https://keepass.info/
- https://keepass.info/download.html
- https://www.vulncheck.com/advisories/keepass-2.35-through-2.61.1-memory-exhaustion-via-kdbx-header-field-size
ADP enrichment
No English description supplied.
No references supplied.