Heap-based Buffer Overflow in sqlite-vec
Published: September 25, 2024
SECURITY IDENTIFIERS
- CVE: CVE-2024-46488 (NVD)
- GHSA: GHSA-vrcx-gx3g-j3h8
GEM
SEVERITY
CVSS v3.x: 9.1 (Critical)
PATCHED VERSIONS
>= 0.1.3
DESCRIPTION
sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Workaround for CVE in release 0.1.3.