The vulnerability CVE-2024-23684 affects the DecodeFromBytes function in the com.upokecenter.cbor Java implementation of CBOR versions 4.0.0 to 4.5.1. It is classified as CWE-407 (inefficient algorithmic complexity), allowing an attacker to trigger a denial of service by supplying specially crafted input that causes excessive resource consumption during decoding. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation results in denial of service by exhausting resources during the decoding process of CBOR data. There is no confidentiality or integrity impact reported. The vulnerability can be triggered remotely if the application processes untrusted CBOR input using the affected library versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation or limiting resource usage during CBOR decoding to mitigate potential denial of service. Monitor vendor channels for updates and apply patches promptly once released.