{"id":"CVE-2023-3766","aliases":["GHSA-gpcv-p28p-fv2p","RUSTSEC-2023-0095"],"url":"https://o3.security/vulnerability/CVE-2023-3766","summary":"Invalid Slice Split Results in Server Panic","details":"A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients.\n\n### Impact\nAn attacker with knowledge of this vulnerability could craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.\n\n### Patches\nUsers are encouraged to update their odoh-rs's rust crate to v1.0.2.","published":"2023-08-03T13:49:46.751Z","modified":"2026-10-28T02:30:26.465108337Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"odoh-rs","fixedVersion":"1.0.2"}],"fix":{"url":"https://github.com/cloudflare/odoh-rs/pull/28","label":"cloudflare/odoh-rs#28"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3766.json"},{"type":"ADVISORY","url":"https://github.com/cloudflare/odoh-rs/security/advisories/GHSA-gpcv-p28p-fv2p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3766"},{"type":"FIX","url":"https://github.com/cloudflare/odoh-rs/pull/28"},{"type":"PACKAGE","url":"https://github.com/cloudflare/odoh-rs"},{"type":"WEB","url":"https://github.com/cloudflare/odoh-rs/commit/c1bc4ed71dcc9842b7dc1ea26f278f105074bbaa"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0095.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:26.465108337Z"}}