{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"exiv2","cve_ids":["CVE-2020-18899"],"ecosystem":"PyPI","epss":0.01658,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGFSEV4KQ1013QRTFDANKE","modified_at":"2025-10-09T07:51:28.004855Z","published_at":"2021-08-19T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-879","https://github.com/Exiv2/exiv2/issues/742","https://cwe.mitre.org/data/definitions/789.html","https://security.gentoo.org/glsa/202312-06"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2021-879","url":"https://osv.dev/vulnerability/PYSEC-2021-879"}],"summary":"An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input."}