-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from recursive type processing without validation. The patch added 'isValidTypeTree' to validate type hierarchies before processing, indicating the original recursion in appendOrcTypesRebuildSubtypes lacked proper cycle checks. The function's recursive nature and position in the type parsing flow make it the entry point for uncontrolled recursion when handling maliciously crafted type trees.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.orc:orc | maven | >= 1.0.0, < 1.4.4 | 1.4.4 |