CVE-2021-43045: 
C# vulnerability analysis and mitigation

A vulnerability in the .NET SDK of Apache Avro (CVE-2021-43045) was discovered that allows attackers to allocate excessive resources, potentially causing a denial-of-service attack. This vulnerability affects .NET applications using Apache Avro version 1.10.2 and prior versions. The issue was disclosed on January 6, 2022, and tracked as AVRO-3225 and AVRO-3226 (Apache Advisory, OSS Security).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, and can result in high availability impact (NVD).

The vulnerability can lead to denial-of-service conditions in affected systems by allowing attackers to cause excessive resource allocation. This primarily affects the availability of services running on .NET applications that use the vulnerable versions of Apache Avro (NVD).

Users are advised to update to Apache Avro version 1.11.0, which addresses this vulnerability. This is the primary mitigation strategy recommended by the vendor (Apache Advisory).

The vulnerability was responsibly disclosed, with credit given to Philip Sanetra for reporting the issue (OSS Security).