Out-of-bounds read in bl
Priority LOW 33CWE-126Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Why it matters now
EPSS 0.02097 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial bl (npm): 1.2.3, 2.2.1, 3.0.1 +1Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | bl | Fixed in 4.0.3, 3.0.1, 2.2.1, and 1.2.3 | — | No fix listed | CNA |
| — | bl (npm) | before 1.2.3 | 1.2.3 | Patch available | GHSA-pp7h-53gx-mx7r |
| — | bl (npm) | 2.0.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-pp7h-53gx-mx7r |
| — | bl (npm) | 3.0.0 to before 3.0.1 | 3.0.1 | Patch available | GHSA-pp7h-53gx-mx7r |
| — | bl (npm) | 4.0.0 to before 4.0.3 | 4.0.3 | Patch available | GHSA-pp7h-53gx-mx7r |
- bl Vendor— Affected Fixed in 4.0.3, 3.0.1, 2.2.1, and 1.2.3 Fixed in — No fix listed CNA
- bl (npm) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-pp7h-53gx-mx7r
- bl (npm) Vendor— Affected 2.0.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-pp7h-53gx-mx7r
- bl (npm) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-pp7h-53gx-mx7r
- bl (npm) Vendor— Affected 4.0.0 to before 4.0.3 Fixed in 4.0.3 Patch available GHSA-pp7h-53gx-mx7r
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:* | before 1.2.3; 2.0.0 to before 2.2.1; 3.0.0 to before 3.0.1; 4.0.0 to before 4.0.3 | Vulnerable | Bufferlist Project |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:* Versions before 1.2.3; 2.0.0 to before 2.2.1; 3.0.0 to before 3.0.1; 4.0.0 to before 4.0.3 Vulnerable ·Bufferlist Project
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-pp7h-53gx-mx7r bl (npm) Fixed in 1.2.3 Advisory →
- Fix · GHSA-pp7h-53gx-mx7r bl (npm) Fixed in 2.2.1 Advisory →
- Fix · GHSA-pp7h-53gx-mx7r bl (npm) Fixed in 3.0.1 Advisory →
- Fix · GHSA-pp7h-53gx-mx7r bl (npm) Fixed in 4.0.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8244
- 2026-10-03 Alias added: GHSA-pp7h-53gx-mx7r
References
Exploit 1
Advisory 2
Sources
- CVE-2020-8244 · CVE Program
- CVE-2020-8244 · NVD
- FIRST EPSS
- GHSA-pp7h-53gx-mx7r · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8244 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences