BER/CER/DER decoder panics on invalid input

CVE-2023-39914

What is CVE-2023-39914?

The bcder library by NLnet Labs, up to version 0.7.2, exhibits a vulnerability where it fails to properly handle certain invalid input data. Instead of rejecting such input with an appropriate error message, the library experiences a panic state during the decoding process. This not only impacts the decoding phase but can also affect subsequent content access methods reliant on delayed decoding, potentially leading to service interruption or degradation.

References