Apache Seata 2.2.0 or earlier: Data Amplification via Highly Compressed Data
CVE-2024-54016 Published on March 20, 2025

compression bomb attack in Apache Seata Server
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): through <=2.2.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-54016 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Weakness Type

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2024-54016 has been classified to as a Data Amplification vulnerability or weakness.


Products Associated with CVE-2024-54016

Want to know whenever a new CVE is published for Apache Seata? stack.watch will email you.

Apache Seata
 

Affected Versions

Apache Software Foundation Apache Seata (incubating):

Exploit Probability

EPSS
0.39%
Percentile
59.89%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.