Advisories

An authenticated user whose features.image_generation permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission that the direct image routes enforce, so the denial applied to the UI affordance but not to the server-side generation path.

The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get_verified_user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or approved and later deactivated back to pending, can therefore open an interactive terminal session that the HTTP terminal endpoints would refuse. The missing control is the verified-user …

A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the list response schema deliberately omits it and source export sits behind its own permission. The read endpoints delivered it …

Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the browser of whoever views it. Every surface that renders messages is affected, including shared chats and channels, …

With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a page could use its own JavaScript to reach addresses the validation exists to block. Because the loader returns the page's final DOM to the requesting …

Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is served from a path on the application's own origin, so the sandbox provided no isolation at all. Script in a previewed file could read the victim's …

In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences, synchronously, on the event loop that also serves the scheduler, HTTP and WebSocket traffic. Nothing bounds the walk, and nothing moves it off the loop.

Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a public address during the check and an internal one at connect, so the fetch reaches an address the check was meant to block. Every user-reachable …

A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.

Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file id could therefore have the builtin knowledge tools return that file's indexed content back to them.

Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET requests, and read back responses from same-origin or CORS-permissive targets into the rendered page. Because the request comes from the browser, …

On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could rewrite or permanently delete any other participant's messages. The group and direct message branch of the same handlers enforced authorship; the standard …

The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that path. A single crafted pattern and a single short line of matching text pin one CPU core for as long as the attacker wants, and because …

Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and does not look at the IPv4 address embedded inside it. On a deployment whose network has a NAT64 gateway, any verified user can wrap an internal or …

DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.

The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of its own. Anyone holding an access token minted for any client registered with the same provider could exchange it for an Open …

A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of ownership. Root folders were restricted to the owner or an admin, subfolders were not.

A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation.

Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted.

Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches.

A Server-Side Request Forgery (SSRF) in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts.

When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address.

A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members.

When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud …

A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site.

Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.

An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues.

The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content.

Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack.

A missing validation check allowed users to redeem subscription offers that were no longer active.

The POST /api/v1/prediction/:id endpoint — which is unauthenticated (whitelisted in WHITELIST_URLS) — accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checking apiOverrideStatus. This allows an unauthenticated attacker to inject arbitrary properties into the flow execution context of any public chatflow, enabling session hijacking, cross-session data pollution, chat history manipulation, and injection …

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is in WHITELIST_URLS, meaning it requires no authentication. It decrypts the stored credential (containing clientId, clientSecret, refresh_token), sends a refresh request to the configured OAuth provider, and returns the new access_token directly in the response body.

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (accessTokenUrl) without SSRF protections. In runtime validation, this endpoint was reachable without auth, triggered outbound POST requests to an attacker-controlled server, and reflected the full remote response body to the caller (tokenInfo), confirming non-blind SSRF and credential secret exfiltration.

The /api/v1/text-to-speech/generate endpoint is whitelisted (requires no authentication) and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential (OpenAI or ElevenLabs API key) to generate unlimited text-to-speech audio, incurring costs on the chatflow owner's account.

Flowise's HTTP security module (httpSecurity.ts) fails to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list. Due to an ipaddr.js kind mismatch (ipv6 vs ipv4), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to ::ffff:<target_ipv4>, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, …

The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, pandas has a read_pickle() function that deserialises a pickled payload and this can be leveraged to achieve code execution.

The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, pandas has a read_pickle() function that deserialises a pickled payload and this can be leveraged to achieve code execution.

A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like child_process and fs.

A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator, allowing an attacker to re-enable blocked modules like child_process and fs.

Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis (which on Node.js exposes eval and dynamic import()), the attacker can break out of the Python string literal, hand a JS string to js.eval, dynamically import any Node built-in module (fs, child_process, …), and execute arbitrary …

Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis (which on Node.js exposes eval and dynamic import()), the attacker can break out of the Python string literal, hand a JS string to js.eval, dynamically import any Node built-in module (fs, child_process, …), and execute arbitrary …

Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view) What’s wrong (code locations) Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976 $vars is always injected into the code execution sandbox: flowise-src/packages/components/src/utils.ts:1782 The official Variables API is permission-protected (contrast): flowise-src/packages/server/src/routes/variables/ index.ts:11 Why it is a privilege boundary bypass A user/API key might …

The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).

The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav (jadhavdimpy@gmail.com) GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise (latest main branch) Version: flowise-components@3.1.0 FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH (CVSS ~7.5) Type: CWE-862 (Missing Authorization) File: packages/server/src/routes/executions/index.ts:11 Description: The PUT /api/v1/executions/:id endpoint lacks the checkAnyPermission() middleware that protects all other execution endpoints (GET, DELETE). Any authenticated user — regardless of their assigned permissions — can modify any execution record. Evidence: …

In Flowise, the /api/v1/files route is protected only by the feat:files feature gate and does not enforce checkPermission(…) on either GET or DELETE. As a result, any authenticated API key within the organization, even one with unrelated permissions, can list and delete files belonging to other workspaces in the same organization.

The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history (response size >100MB) instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data (e.g., Vector Store settings such as Qdrant Server URL and collection name), resulting in a High severity information disclosure that may enable further targeted attacks.

The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType() function masks fields defined with type: 'password' in their component schema, many credential types store highly sensitive data (database connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys) in fields defined as type: 'string'. These string-type fields are returned in full …

An Insecure Direct Object Reference (IDOR) vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulating the customerId parameter. The exposed data includes email addresses, account balances, currency types, and internal billing configurations.

The mitigation shipped for CVE-2025-8943 blocks the -y and –yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and npm reads its configuration directly from npm_config_* environment variables. Setting npm_config_yes=true reproduces the –yes behaviour the flag filter is meant to prevent, so npx auto-installs and executes the named package. …

The mitigation shipped for CVE-2025-8943 blocks the -y and –yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and npm reads its configuration directly from npm_config_* environment variables. Setting npm_config_yes=true reproduces the –yes behaviour the flag filter is meant to prevent, so npx auto-installs and executes the named package. …

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain Python code injection via base64_string = "${base64String}" (CSVAgent.ts line 161) Pyodide js bridge provides access to the host Node.js process process.mainModule.constructor._load('child_process') loads child_process (bypasses ESM require restriction) .execSync('CMD') executes arbitrary OS commands as root (PID 1 in container) Working RCE Payload ";import …

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain Python code injection via base64_string = "${base64String}" (CSVAgent.ts line 161) Pyodide js bridge provides access to the host Node.js process process.mainModule.constructor._load('child_process') loads child_process (bypasses ESM require restriction) .execSync('CMD') executes arbitrary OS commands as root (PID 1 in container) Working RCE Payload ";import …

– ABSTRACT ————————————- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise – VULNERABILITY DETAILS ———————— Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise (npm install flowise@3.1.1) Platform tested: Ubuntu 25.10 A prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed pyodide …

– ABSTRACT ————————————- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise – VULNERABILITY DETAILS ———————— Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise (npm install flowise@3.1.1) Platform tested: Ubuntu 25.10 A prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed pyodide …

Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints (callback, refresh) are whitelisted from all authentication. This allows: Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against credentials belonging to other workspaces. Unauthenticated token injection — An unauthenticated attacker can forge OAuth2 callbacks to overwrite tokens in any credential. Unauthenticated token refresh — An unauthenticated attacker can refresh …

These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s OpenAI key.

Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other tenants. As a result, an authenticated user can manipulate the Stripe subscription of another organization by supplying a victim organization's subscriptionId. This allows attackers to perform unauthorized billing operations such as changing subscription plans or modifying seat …

Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.join(tempDir, key) and writes the object bytes to disk without validating traversal sequences such as ../. Cleanup later removes only the original temporary directory, so files written outside that directory persist on the host filesystem. …

Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.join(tempDir, key) and writes the object bytes to disk without validating traversal sequences such as ../. Cleanup later removes only the original temporary directory, so files written outside that directory persist on the host filesystem. …

In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission('chatflows:delete,agentflows:delete'). Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW, and a caller with only chatflows:delete to delete an AGENTFLOW.

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25

============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm 3.9.25

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, …

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or RasterField reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A …

Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in …

Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored. In shared-cache mode, this allows a response …

Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key. Parse-time crash: Mixed unqualified-and-qualified private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the …

When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream. The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through …

The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true. Applications that pass user-controlled input to these fields, …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding …

Affects Bouncy Castle for Java LTS before 2.73.12. In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding a revoked certificate can staple any validly signed …

Affects Bouncy Castle for Java before 1.85. In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding a revoked certificate can staple any validly signed response …

Affects Bouncy Castle for Java before 1.85. In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding a revoked certificate can staple any validly signed response …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding …

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3.

Affects Bouncy Castle for Java before 1.85. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker holding …

Affects Bouncy Castle for Java LTS before 2.73.12. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker …

Affects Bouncy Castle for Java before 1.85. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker holding …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips before 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date …

Affects Bouncy Castle for Java LTS before 2.73.12. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcjmail-fips before 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date …

Affects Bouncy Castle for Java before 1.85. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker holding …

Affects Bouncy Castle for Java before 1.85. The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker holding …

There is a server-side channel state issue in russh. After a client is authenticated, russh can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not send SSH_MSG_CHANNEL_OPEN at all. It authenticates normally, then sends SSH_MSG_CHANNEL_REQUEST packets with request type exec for a range of recipient channel IDs. russh still calls the server application's exec_request handler. This …

Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA …

Affects Bouncy Castle for Java LTS before 2.73.12. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP …

Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA …

Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS …

Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the resulting …

Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the resulting …

Affects Bouncy Castle for Java LTS before 2.73.12. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the …

Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the resulting …

When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource …

If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names.

The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { … }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check. PreviousMap is constructed by …

Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as …

Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are …

Affects Bouncy Castle for Java LTS before 2.73.12. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails …

Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 (1.0.X series). Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are …

Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input …

Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, …

Affects Bouncy Castle for Java LTS before 2.73.12. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC …

Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, …

Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and …

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java LTS before 2.73.12. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java LTS before 2.73.12. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and …

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, throwing …

Affects Bouncy Castle for Java LTS before 2.73.12. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment …

Affects Bouncy Castle for Java before 1.85. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, throwing …

Affects Bouncy Castle for Java before 1.85. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, throwing …

Affects Bouncy Castle for Java before 1.85. In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. An attacker with a trusted-key …

Affects Bouncy Castle for Java before 1.85. In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. An attacker with a trusted-key …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 2.0.13 (2.0.X series). In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. …

Affects Bouncy Castle for Java before 1.85. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext bytes …

Affects Bouncy Castle for Java before 1.85. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext bytes …

Affects Bouncy Castle for Java before 1.85. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext bytes …

Affects Bouncy Castle for Java LTS before 2.73.12. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can …

Affects Bouncy Castle for Java before 1.85. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of up …

Affects Bouncy Castle for Java LTS before 2.73.12. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of …

Affects Bouncy Castle for Java before 1.85. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of up …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely …

Affects Bouncy Castle for Java before 1.85. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of up …

Affects Bouncy Castle for Java before 1.85. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have truncated …

Affects Bouncy Castle for Java before 1.85. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have truncated …

Affects Bouncy Castle for Java before 1.85. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have truncated …

Affects Bouncy Castle for Java LTS before 2.73.12. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and …

Affects Bouncy Castle for Java before 1.85. OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with hundreds of nested payloads costs a few bytes per …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcutil-fips before 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with …

Affects Bouncy Castle for Java LTS before 2.73.12. OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with hundreds of nested payloads costs a few bytes …

Affects Bouncy Castle for Java before 1.85. OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with hundreds of nested payloads costs a few bytes per …

Affects Bouncy Castle for Java before 1.85. PKIXNameConstraintValidator strips a trailing dot before comparing dNSName values but not rfc822Name or URI values, which are compared with a plain case-insensitive match. A certificate whose email or URI SAN ends in a dot therefore evades an excludedSubtrees entry for the same host and path validation succeeds. An attacker controlling a name-constrained intermediate CA can issue certificates for names the constraints were meant …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). PKIXNameConstraintValidator strips a trailing dot before comparing dNSName values but not rfc822Name or URI values, which are compared with a plain case-insensitive match. A certificate whose email or URI SAN ends in a dot therefore evades an excludedSubtrees entry for the same host and path validation succeeds. An attacker controlling a …

Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is …

Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is …

Affects Bouncy Castle for Java LTS before 2.73.12. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input …

Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is …

Affects Bouncy Castle for Java before 1.85. MLSInputStream.readOpaque() decodes a varint length of up to about 1 GiB and allocates a buffer of that size before confirming enough bytes remain. The call is reached on the first fields of unauthenticated wire structures, ahead of any signature or MAC check. A few bytes declaring a maximal length force a gigabyte allocation per message, and a handful of concurrent messages exhaust the …

Affects Bouncy Castle for Java before 1.85. GroupKeySet.HashRatchet.get() advances the ratchet one generation at a time up to the requested value and caches every intermediate key in an unbounded map. The generation comes from the SenderData of an incoming PrivateMessage, is a 32-bit value encrypted only under the group-shared sender data secret, and is used before any per-message signature check. Any authenticated member can request a maximal generation and force …

Affects Bouncy Castle for Java before 1.85. The escaping added for CVE-2023-33201 and CVE-2026-0636 reached the main Java sources and the jdk1.4 X509LDAPCertStoreSpi but not the jdk1.4 LDAPStoreHelper, whose parseDN() returns an unescaped DN component that callers concatenate into an LDAP filter. Because the jdk1.4 build replaces the patched file with this variant, bcprov-jdk14 never received the fix. A certificate with crafted CN characters can splice extra clauses into the …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). LazyEncodedSequence.force() parses the deferred SEQUENCE with a fresh nesting-depth counter instead of inheriting the parent's remaining budget, and never decrements it. CRLs loaded through X509CRLHolder or the BC CertificateFactory hold revokedCertificates as an unforced lazy sequence, so a 40-50 KB DER CRL nesting around 10,000 SEQUENCEs recurses one frame per level …

Affects Bouncy Castle for Java before 1.85. LazyEncodedSequence.force() parses the deferred SEQUENCE with a fresh nesting-depth counter instead of inheriting the parent's remaining budget, and never decrements it. CRLs loaded through X509CRLHolder or the BC CertificateFactory hold revokedCertificates as an unforced lazy sequence, so a 40-50 KB DER CRL nesting around 10,000 SEQUENCEs recurses one frame per level on hashing, comparison or encoding. The resulting StackOverflowError is usually uncaught and …

Affects Bouncy Castle for Java before 1.85. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext and …

Affects Bouncy Castle for Java LTS before 2.73.12. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext …

Affects Bouncy Castle for Java before 1.85. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext and …

Affects Bouncy Castle for Java before 1.85. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext and …

Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series). HostnameUtil gates the fallback that matches the certificate CN when no dNSName SAN is present on a property whose unset default the code treats as enabled, contrary to its documentation. Because name-constraint processing only constrains SAN entries of the constrained type, a leaf with no dNSName SAN passes a dNSName-constrained chain, …

Affects Bouncy Castle for Java before 1.85. HostnameUtil gates the fallback that matches the certificate CN when no dNSName SAN is present on a property whose unset default the code treats as enabled, contrary to its documentation. Because name-constraint processing only constrains SAN entries of the constrained type, a leaf with no dNSName SAN passes a dNSName-constrained chain, and the verifier then matches the attacker-chosen CN against the target hostname.

Affects Bouncy Castle for Java LTS before 2.73.12. HostnameUtil gates the fallback that matches the certificate CN when no dNSName SAN is present on a property whose unset default the code treats as enabled, contrary to its documentation. Because name-constraint processing only constrains SAN entries of the constrained type, a leaf with no dNSName SAN passes a dNSName-constrained chain, and the verifier then matches the attacker-chosen CN against the target …

Affects Bouncy Castle for Java before 1.85. HostnameUtil gates the fallback that matches the certificate CN when no dNSName SAN is present on a property whose unset default the code treats as enabled, contrary to its documentation. Because name-constraint processing only constrains SAN entries of the constrained type, a leaf with no dNSName SAN passes a dNSName-constrained chain, and the verifier then matches the attacker-chosen CN against the target hostname.

Address6's special-property checks misclassify IPv4-mapped (::ffff:0:0/96) and NAT64 well-known (64:ff9b::/96) IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so isLoopback(), isLinkLocal(), isMulticast(), and isUnspecified() all return false for literals such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254 that actually route to loopback, RFC 1918, or link-local (cloud-metadata) destinations. Address6 also had no isPrivate() method, so a mapped RFC 1918 address could not …

Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks …

Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return …

Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without …

Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without …

Affects Bouncy Castle for Java LTS before 2.73.12. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, …

Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. …

Affects Bouncy Castle for Java before 1.85. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature can …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. …

Affects Bouncy Castle for Java LTS before 2.73.12. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature …

Affects Bouncy Castle for Java before 1.85. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature can …

The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.

In affected versions, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address …

SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and mixed-base forms such as 0x7f000001 and 0177.0.0.0x1 go unrecognized while libcurl 8.21.0 reads both as 127.0.0.1, so closing them completes the rule …

GitPython blocks dangerous git options through Git.check_unsafe_options(), gated per method by an allow_unsafe_options parameter. That guard is applied per call site, so any API that forwards **kwargs into a git command without calling it passes caller-controlled options straight to git. A mechanical sweep of every method that forwards **kwargs into a .git.<command>(…) call found 14 sites with no guard. Two reach a git option that takes a filesystem path: | …

Repo.archive() does call the option guard, so this is not a missing-guard report. The guard is present and working; the denylist it consults is incomplete.

Commit.count() forwards **kwargs into rev_list with no check_unsafe_options guard (the guard exists only in the sibling iter_items, commit.py:341). git rev-list –output=<path> opens and truncates the target file to 0 bytes before revision parsing, so count(output='/victim') destroys/blanks an arbitrary file.

fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) instead treats \ as interchangeable with / for special …

Affects Bouncy Castle for Java before 1.85. DTLSReliableHandshake.processRecord() allocates a reassembly buffer sized from the 24-bit handshake length field of an incoming record, without the maximum-message-size check the stream-TLS path applies. Up to sixteen message sequences may be buffered per connection, so a single record of about 205 bytes carrying sixteen fragment headers with a maximal length forces roughly 256 MiB of allocation before any authentication. A few small UDP …

Affects Bouncy Castle for Java before 1.85. DTLSReliableHandshake.processRecord() allocates a reassembly buffer sized from the 24-bit handshake length field of an incoming record, without the maximum-message-size check the stream-TLS path applies. Up to sixteen message sequences may be buffered per connection, so a single record of about 205 bytes carrying sixteen fragment headers with a maximal length forces roughly 256 MiB of allocation before any authentication. A few small UDP …

Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series). DTLSReliableHandshake.processRecord() allocates a reassembly buffer sized from the 24-bit handshake length field of an incoming record, without the maximum-message-size check the stream-TLS path applies. Up to sixteen message sequences may be buffered per connection, so a single record of about 205 bytes carrying sixteen fragment headers with a maximal length forces …

Affects Bouncy Castle for Java LTS before 2.73.12. DTLSReliableHandshake.processRecord() allocates a reassembly buffer sized from the 24-bit handshake length field of an incoming record, without the maximum-message-size check the stream-TLS path applies. Up to sixteen message sequences may be buffered per connection, so a single record of about 205 bytes carrying sixteen fragment headers with a maximal length forces roughly 256 MiB of allocation before any authentication. A few small …

Affects Bouncy Castle for Java before 1.85. DTLSReliableHandshake.processRecord() allocates a reassembly buffer sized from the 24-bit handshake length field of an incoming record, without the maximum-message-size check the stream-TLS path applies. Up to sixteen message sequences may be buffered per connection, so a single record of about 205 bytes carrying sixteen fragment headers with a maximal length forces roughly 256 MiB of allocation before any authentication. A few small UDP …

pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Introduced in 44.0.0. Fixed in 50.0.0.

Affects Bouncy Castle for Java LTS before 2.73.12. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies …

Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies to …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number …

Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies to …

Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies to …

Affects Bouncy Castle for Java LTS before 2.73.12. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of …

Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of authenticity …

Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of authenticity …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content …

Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of authenticity …

Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before returning …

Affects Bouncy Castle for Java LTS before 2.73.12. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients …

Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before returning …

Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before returning …

Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and MAC …

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An …

Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and MAC …

Affects Bouncy Castle for Java LTS before 2.73.12. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and …

Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and MAC …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer …

Affects Bouncy Castle for Java LTS before 2.73.12. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, …

Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing …

Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer …

Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing …

The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help. A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes …

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.

Affects Bouncy Castle for Java LTS before 2.73.12. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select …

Affects Bouncy Castle for Java LTS before 2.73.12. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can …

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select …

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select …

Affects Bouncy Castle for Java LTS before 2.73.12. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is …

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours …

Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours …

Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.

Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas: new HttpParams().set('role', 'user,admin') new HttpParams().append('role', 'user').append('role', 'admin') Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements. However, domino's serializer previously …

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror). When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" …

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror). When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" …

The client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated.

An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.

The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or …

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked …

NonFinalizedState::handle_reorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previous_block_hash points back to itself (or forms a cycle with other blocks), causing handle_reorg to infinite-loop, consuming 100% CPU and never making sync progress. Additionally, update() contains an .expect("empty …

The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always returns success: true regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only success: Boolean. However, a deprecated user field is still registered on the …

Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.

A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any {{config.<path>}} placeholder in a replacement value is resolved against the full marshalled daemon configuration, with no restriction on which paths may be read. Because the Panel substitutes user-controlled egg variable values into these …

The vault-secrets-webhook reads the vault.security.banzaicloud.io/vault-addr annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with vault:, the webhook's admission handler synchronously calls the Vault API at the attacker-supplied address from inside the webhook process during the admission review. The webhook additionally grants serviceaccounts/token:create cluster-wide, and the vault-serviceaccount annotation controls …

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines …

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains …

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

The shop payment webhook POST /{_locale}/update-payment (route sylius_mollie_shop_payment_webhook) accepts two independent, attacker-controlled parameters: id (the Mollie payment ID, verified against Mollie's API) and orderId (the Sylius order ID, read directly from the database). The handler never verifies that the Mollie payment belongs to the referenced order. An unauthenticated attacker who holds any valid paid Mollie payment ID, for example from a EUR 1 order they placed themselves, can submit it …

Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /{_locale}/thank-you (PageRedirectController::thankYouAction, route sylius_mollie_shop_thank_you_page_redirect) loads the order with findOneBy(['id' => $orderId]) and returns a 302 whose Location header carries that order's tokenValue. Any orderId thus yields that order's token. A non-existent id dereferences null and returns a 500. The handler also writes the raw orderId …

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation (Algorithmic DoS)

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place …

Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe.

sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs (action, formaction, data, poster, background, ping, xlink:href, dynsrc, lowsrc), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, javascript: URIs pass through completely unmodified, enabling XSS. The …

rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named shell.php.any.jpg and, on web servers whose PHP handler matches .php as any …

re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those two values passes validation while pointing past the end of the buffer. The subsequent walk reads out of bounds. With a large …

String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width (empty) match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (a*, b?, x{0,3}, (a)|, (?:), …) therefore causes an infinite loop with unbounded memory growth. The …

Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.

OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disable_files setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint (–disable-files / "Disable uploading files"), a remote sender who can reach the OnionShare service can still send a crafted multipart request containing file[]; OnionShare writes the uploaded bytes to disk before the route handler skips file accounting. This affects the shipped onionshare-cli Python package …

OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise untrusted symlinks, a remote recipient with access to the OnionShare service can read arbitrary local files readable by the OnionShare process that the symlink points to. This affects …

GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any authenticated account reaches it. The default auth-basic authenticator ships allowSignUp: true, so the account is obtainable anonymously. The injection is reachable with the URL parameter filter[latestMsgReceiveTimestamp][$lt]=<expression>. The pg driver in front …

A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(…) retains the frame buffer but never releases it on the error path, so its reference count never returns to zero. Repeating this over a long-lived HTTP/2 connection exhausts direct memory and crashes …

ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit (e.g. a label then [+2]) from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups followed by another word, which must then be followed by a literal [. On a long bracket-less line the label can match from every search position to the end …

A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods (header, raw, words, sents, tagged_words) to read files outside the corpus root. The reader builds the file path with no containment check and opens it with the builtin open(), so it bypasses NLTK's nltk.pathsec sandbox — including the strict ENFORCE = True mode that SECURITY.md recommends for web/multi-tenant deployments. header() returns …

nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding: validate_network_url() resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result. The validated IP is never the …

FramenetCorpusReader.frame(name) interpolates a caller-supplied frame name into an XML file path that is read with the builtin open(), bypassing CorpusReader.open() and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an arbitrary XML file read whose parsed content is returned to the caller.

Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype (prototype pollution).

jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace(/[\u0000-\u0020]+/g, '') and lowercases the value before testing the scheme. Because the href check does neither, it is bypassed by three obfuscation classes, all confirmed firing on click against the shipped 4.12.30 build: Case variants: JAVASCRIPT:, Javascript:, jaVaScRiPt: (the check is …

A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, …

jodit's built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img … onload=…> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) …

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read and that can result in a crash.

The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.

The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality. This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse directories and access files outside the intended web root directory. The issue was identified and reported through the DWF (Distributed Weakness Filing) project, which assigns CVE …

consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read.

The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of special_chars mutations produce HTTP 500—causing denial …

The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of special_chars mutations produce HTTP 500—causing denial …

The subtitlesHandler endpoint (GET /api/media/subtitles) accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed directly to idx.GetRealPath() without calling SanitizeUserPath(), allowing an attacker to escape the storage root and set parentDir to any directory on the host. No existing anchor file is required. The secondary …

is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.

GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled external site, even though the code attempts to restrict redirect targets to relative, in-application URLs. This affects both supported SSO login methods: OAuth2/OIDC and Keycloak.

CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers regexp.MustCompile() in pkg/api/forbidden_list.go:36, which panics and crashes the node admission webhook — causing a cluster-wide Denial of Service for all Node operations.

CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources (e.g. ClusterRole, ValidatingWebhookConfiguration) through a TenantResource, because the controller applies them with its cluster-admin ServiceAccount and SetNamespace is ineffective for cluster-scoped kinds. The v0.13.0 fix added a cluster-scope rejection guard, but only on the NamespacedItems selection path (ResourceReference.LoadResources -> IsNamespacedGVK, error "cluster-scoped kind … is not allowed"). The RawItems create path — the exact vector the original advisory named …

apos.util.set() traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck() causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.

The local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases.

@dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode (–http flag) that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an Authorization header and have it executed directly under the victim server's Dynatrace credentials. Confirmed high-impact tools reachable without authentication include execute_dql (reads arbitrary Grail data, including logs, security events, and user sessions) and create_dynatrace_notebook (writes …

A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as proto, constructor, and prototype. An attacker able to supply crafted input could cause properties to be written to Object.prototype, resulting in prototype pollution affecting all objects within the running process. Applications that pass untrusted input to defaultsDeep() may be impacted. Depending on how the application uses …

A template injection vulnerability in the create_workflow_for_notification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends.

A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers.

The @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script> tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.

When prettyUrls: true is enabled on @apostrophecms/file (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw Host HTTP request header: proxyUrl = ${req.protocol}://${req.get('host')}${uglyUrl} That URL is then fetch'ed and the response body + headers are streamed straight back to the requester. Because Host is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue …

OliveTin's OAuth2 login handler stores per-login state in an in-memory map (registeredStates) that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/login to fill the map with state entries, exhausting server memory and causing a denial of service. This is distinct from CVE-2026-28789 (concurrent map writes crash). That CVE was about the panic from …

The synchronous execution RPCs StartActionAndWait and StartActionByGetAndWait return the full LogEntry for the just-executed action without checking whether the caller is allowed to read that action's logs. OliveTin's ACL model separates exec from logs. A deployment can intentionally allow a user to run an action while denying access to its historical or live output. That separation is enforced in GetLogs, GetActionLogs, ExecutionStatus, and EventStream, but it is not enforced in …

OliveTin's checkShellArgumentSafety() function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex(), any Shell mode action using a regex:-typed argument bypasses the safety check unconditionally. The unvalidated value is then interpolated directly into the sh -c command string via Go's text/template with no escaping, enabling shell injection. Notably, even restrictive-looking patterns are exploitable — …

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the …

In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that removes them is an explicit client-issued HTTP DELETE. An unauthenticated attacker can repeatedly initialize new sessions and immediately disconnect, forcing the server to retain an unbounded number of ServerSession objects until memory is exhausted.

The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IO#gets with no limit argument. CRuby's IO#gets with no limit reads from the current position until the next separator (\n) with no upper bound on the returned string length. A peer that streams bytes without ever emitting a newline causes gets to accumulate the entire stream in a single Ruby String until the process is killed by the …

An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with JSON.parse(body, symbolize_names: true) with no size limit, no Content-Length pre-check, and no streaming parser, allowing trivial denial of service against the worker process.

MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable Streamable HTTP transport in the mcp gem) processes every incoming JSON-RPC request without ever inspecting the HTTP Host or Origin request headers. There is no AllowedHosts/AllowedOrigins allowlist and no DNS-rebinding guard anywhere in the transport. A local MCP server that binds a loopback or LAN HTTP port is therefore reachable by any web origin a victim's browser visits, via a DNS-rebinding attack: a malicious page rebinds its …

Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim

lib.url.fetch() follows HTTP redirects (follow_redirects=True). httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish's X-Auth-Token, an API key, …) was still sent to the redirect target. A malicious or redirect-capable server can therefore answer an authenticated request with a 3xx to an attacker-chosen host and receive the credential (server-side request forgery + token disclosure). The …

The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's callback_url is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTO_RUNNER_SECRET. The callback_url bypasses the service's target_allowed allowlist (which only inspects params.target_url) and is never passed through any SSRF guard. This yields (a) unauthenticated SSRF to internal/metadata endpoints with an attacker-controlled JSON body, and (b) exfiltration of …

Numerous HTTP-emitting modules (core.api.http_get, core.api.http_post, graphql.query/graphql.mutation, monitor.http_check, communication.slack_send, notification.{discord,slack,teams}.send_message, ai.vision_analyze [anthropic path], verify.visual_diff, browser.proxy_rotate, and the agent/llm inline base_url branch) perform outbound requests to a fully client-controlled URL without calling the project's own SSRF guard (validate_url_with_env_config) that their sibling modules apply. An authenticated workflow-author can point the URL at the cloud metadata IP (169.254.169.254), a loopback/RFC1918 host, or any internal host and read the response, yielding cloud-metadata credential theft and …

llm.chat reads the operator's provider key from the environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) and sends it in the Authorization: Bearer header to base_url, a parameter the caller controls. base_url is only checked against the SSRF guard, and the guard allows any public host, so pointing base_url at an attacker's server hands them the operator's key. flyto-core's own bounty scale rates "environment access exposing secrets (e.g. ANTHROPIC_API_KEY)" as High.

The HTTP modules that DO call the SSRF guard (http.get, http.request, http.batch) validate only the initial URL, then issue the request with aiohttp's default allow_redirects=True and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; the guard passes on the public host and aiohttp transparently follows the redirect into internal space, returning the internal body.

image.download fetches a URL and writes the response to disk. It does not use the central path guard (validate_path_with_env_config, which confines writes to FLYTO_SANDBOX_DIR); instead it confines the output to output_dir, but output_dir is itself a caller parameter. Since the attacker sets both the target and the base it is checked against, the check is meaningless, and attacker-controlled bytes (the HTTP response) land at any absolute path the process can …

The capability policy denies the env.get and env.load_dotenv modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variable resolver expands ${env.VAR} for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out …

is_url_safe in v1.0.3 contains an SSRF bypass. remove_at_symbol_in_string is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.

The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS CLI) for generating component files in customers' local applications. An issue exists in the Amplify Studio property binding process of the amplify-codegen-ui package that could potentially allow an authenticated user to run arbitrary …

In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.

A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While GHSA-282g-fhmx-xf54 (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling UpdateHumanUser with email.is_verified: true, additional paths were discovered.

veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and GFPDAcroForm.getdynamicRender()). A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values or XFA configurations, allowing local file disclosure and potentially outbound network requests depending on the runtime (host) environment.

veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and GFPDAcroForm.getdynamicRender()). A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values or XFA configurations, allowing local file disclosure and potentially outbound network requests depending on the runtime (host) environment.

Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation.

Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation.

Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affects all current versions of veraPDF-validation.

Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affects all current versions of veraPDF-validation.

Description A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allows a remote attacker to exhaust validator memory or CPU by submitting a PDF whose Type 1 font /FontFile is a font program containing attacker-supplied PostScript. veraPDF's Type 1 font program parser dispatches every cleartext token through a hardcoded operator allow-list whose members include the unbounded array N allocation operator and the for control operator with no zero-increment guard. This …

Description A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allows a remote attacker to exhaust validator memory or CPU by submitting a PDF whose Type 0 font /Encoding (or any /ToUnicode) is a CMap stream containing attacker-supplied PostScript. veraPDF reuses its CMap parser as a general PostScript interpreter and exposes the unguarded array N allocation operator and the for control operator with no zero-increment guard. This affects all current …

swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an http(s):// URL, issues an HTTP GET to that URL during generation (warmUpRemoteSchemasCache). The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, no DNS-rebinding protection, no redirect cap, and no same-origin check against the spec source. A malicious OpenAPI spec can therefore force the generator process …

swagger-typescript-api interpolates OpenAPI path strings (the keys of the paths object, e.g. /users/{id}) directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing ${ … } survives parseRouteName's {x} / :x rewriter verbatim and lands as live JS-template-literal interpolation inside the generated path: ...`` line. Any consumer who calls the affected generated method evaluates the attacker's expression with full importer …

swagger-typescript-api interpolates components.schemas.*.enum[i] string values into the body of generated TypeScript enum declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at module load the first time the generated client is imported. The trigger requires no instantiation and no method call — only an import of the generated module. The attacker controls the OpenAPI spec …

swagger-typescript-api interpolates servers[0].url directly into a TypeScript class-body field initializer of the generated fetch HttpClient (templates/base/http-clients/fetch-http-client.ejs:75), without any escaping. A malicious URL containing a " closes the string literal that initializes public baseUrl and exposes the surrounding class body to injection. The most direct exploit declares a new static field whose initializer is an async IIFE — TypeScript evaluates static field initializers at class definition time, which is at module …

swagger-typescript-api interpolates servers[0].url directly into a TypeScript string literal inside the HttpClient constructor body of the generated axios client (templates/base/http-clients/axios-http-client.ejs:71), without any escaping. A malicious URL containing a " closes the string literal and exposes the surrounding object-literal argument of axios.create({…}) to injection. A computed property key whose value is an IIFE executes arbitrary code every time new HttpClient() (or new Api(), which extends HttpClient) is constructed. The attacker controls …

When the developer supplies an –authorizationToken (commonly required to fetch a private spec behind authentication), swagger-typescript-api attaches that token to the Authorization header of every subsequent HTTP request it makes while resolving external $ref URLs in the spec — with no same-origin check, no host allowlist, and no scope-down for cross-origin requests. A malicious OpenAPI spec containing a $ref to an attacker-controlled URL therefore causes the developer's bearer token to …

Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.

When restoring a crafted backup archive, proot-distro restore accepts hardlink entries whose source path references a different installed container. The restore logic resolves the hardlink source from the archive's linkname field and copies the referenced file into the container identified by the archive entry. Although path traversal protections correctly keep the source path inside the proot-distro containers directory, no validation ensures that the hardlink source container matches the destination container. …

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the –only-binary option as installing source distributions from an …

Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as ../, causing files to be written outside the intended download directory on the Penelope operator's machine. The impact is limited to files writable by the user running Penelope. …

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, potentially leading to denial of service. The issue affects only deployments where RMI …

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.

Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers. Olm is a …

0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped.

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS.

The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path, a value in record_transformer.records can close the current <record> / <filter> block and add a new <match **> block. By specifying Fluentd's core @type exec plugin …

Google::oauth at application/controllers/Google.php:278 stores its URL-supplied provider_id in the session, and oauth_callback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data.

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover.

The booking reschedule view at /index.php/booking/reschedule/{appointment_hash} (handled by Booking::index()) embeds the entire customer record as inline JavaScript (const vars = {… "customer_data": {…}, …}) without authentication and without field whitelisting. Anyone in possession of the 12-character appointment_hash — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the ea_users table. Verified against v1.5.2 with …

Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request's caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind.

Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disable_booking_message setting via a rich-text editor and later passed directly to the public booking_message view without escaping or sanitization: <p><?= vars('message_text') ?></p> An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking …

Easy!Appointments correctly filters provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and appointments/update only check generic appointment privileges and never verify that the submitted id_users_provider belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via store, or reassign existing appointments into a foreign provider's calendar via update. The store …

The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the agentcore add agent –type import command, resulting in arbitrary code execution when the generated file is loaded or deployed.

Active Record Tenanted's override of Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.

Repository: termux/proot-distro Component: proot_distro/commands/install.py → _extract_plain_tar(); also helpers/docker.py → _apply_layer()

A missing human-approval gate on the create_dynatrace_notebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.

WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the …

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, potentially OOM termination) by sending a crafted unencrypted MTProto packet. (*proto.UnencryptedMessage).Decode read an attacker-controlled 32-bit dataLen field and immediately allocated a buffer of that size via make([]byte, dataLen) before validating that the underlying buffer actually contained that many bytes. A 20-byte packet declaring a ~1.75 GB payload (e.g. dataLen = 0x70000000) forces the runtime to …

Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{proto.foo}', value: 'malicious' }. This has been confirmed with a test/reproduction. You are impacted when: direct usage of convertTokenData(tokens, { output: 'object' }); indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it …

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (copy_dir_all) classified each entry with std::fs::DirEntry::file_type() — which does not follow symlinks — and then copied non-directory entries with std::fs::copy(), which does dereference symlinks. As a result, a skill containing a symbolic link such as reference.txt -> /home/<user>/.ssh/id_rsa was copied as a regular file whose contents are the link's target. A …

A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet (and STUN attribute) bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception into a channel Close rather than dropping the packet. One small, unauthenticated packet therefore ends the media session. This is reachable during ICE connectivity checks …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup(), bearer tokens are stored only under the default suffix paths (e.g., /hook/account-tx), but the custom path (e.g., /hook/custom) is never added to the token map. When an incoming request arrives at the custom path, self._tokens.get(path) returns None, causing the if expected_token is not None guard to evaluate …

The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This …

A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing …

A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing …

Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Three independent code paths are affected: Primary (Critical): …

The createTokenFromRefreshToken function (oidc_service.go:451) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows three bypasses: Authorization revocation bypass: After a user revokes an OIDC client's authorization, the client can continue refreshing tokens indefinitely because RevokeAuthorizedClient does not delete associated refresh tokens, and the refresh flow does not check if the authorization record still exists. Disabled user bypass: After …

A weaker authentication method (OTA token or signup token) is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with RequiresReauthentication: true. The POST /api/webauthn/reauthenticate endpoint's access-token fallback checks only JWT freshness (IssuedAt within 60 seconds), not the authentication method used. The session cookie gate is also non-validating – any arbitrary cookie value (e.g. session=deadbeef) is accepted, collapsing the reauth boundary to token …

Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file (<locale>.yml). An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params[:locale] — let that input influence which file Pagy attempted to load.

openhole-server forwarded the URL-decoded request path (r.URL.Path) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (%2e) and separators (%2f) were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.

When an application uses OAuth2::Client (typically via an OAuth2::AccessToken) and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Client#request resolves the redirect with response.response.env.url.merge(location). Per RFC 3986 §5.2, an input that starts with // is a network-path reference and replaces the authority of the base URL: URI("http://idp.trusted/userinfo").merge("//attacker.example/leak") returns http://attacker.example/leak. The recursive request(verb, full_location, req_opts) call then re-sends the request to …

When an application uses OAuth::Consumer to request OAuth 1.0 request tokens or access tokens, the token request helper follows 300..399 redirects returned by the OAuth server. In affected versions, OAuth::Consumer#token_request parses the raw Location header, follows the redirect recursively, and can mutate the consumer's configured site when the redirect points to a different host with the same path. The result is a cross-origin signed-request disclosure primitive: if an OAuth server …

Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: ~/.config/nono/packages/lockfile.json ~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.

The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pg_shadow, pg_roles, or pg_stat_activity. An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pg_shadow), …

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack.

An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the boring-tls feature. Other TLS backends (native-tls, rustls) are unaffected.

When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no host validation, and no user notification.

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This …

The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32(headerSize) without first ensuring avp.Length >= headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length < 8. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the uint32 subtraction to ~4,294,967,292, which is passed straight to make([]byte, dataLength). A …

A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted. Callers included the builder's Clean handler (pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A …

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability check was implemented as a fixed denylist of six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted CAP_SYS_TIME, among others. As a result, a tenant who could create a Function or Environment CRD could request securityContext.capabilities.add: ["SYS_TIME"], pass Fission's admission validation and …

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. A tenant with HTTPTrigger …

When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin (host/port/scheme). Credentials that an operator scoped to a trusted schema host are therefore forwarded to an attacker-controlled or otherwise different host, leaking them.

JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The –allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a deprecation warning and then fetches the URL anyway; only explicit –allow-remote-refs=false blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated .py source. As a …

datamodel-code-generator's built-in HTTP fetcher (http.get_body) issues an httpx.GET against any URL passed to –url (or reached via a redirect chain) with no allow-list, no deny-list, no IP/host validation, and follow_redirects=True. Loopback addresses, RFC1918 ranges, link-local (169.254.169.254 cloud metadata), unique-local IPv6 and any other network-accessible target are all reachable. The JSON/YAML response body is parsed as a schema and reflected into the generated .py source, exfiltrating the response to anyone with …

datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at connection time (DNS rebinding) bypasses the guard and reaches loopback, link-local cloud-metadata endpoints (169.254.169.254), and other internal services — even with the default …

A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the from … import … line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote …

When generating models from an XML Schema (–input-file-type xmlschema), datamodel-code-generator resolves <xs:include>, <xs:import>, <xs:redefine>, and <xs:override> schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read arbitrary files via ../ traversal or an absolute path, and the included schema's contents (type names, restrictions, enumerations) are folded into the generated output. Unlike the JSON-Schema $ref …

datamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema (a "paste your OpenAPI/JSON-Schema" service, a CI job that generates models from a submitted spec, or any multi-tenant codegen platform) can read any file the process user can read and map the host filesystem. …

GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This was confirmed locally by routing a request through the real tokenMiddleware with Authorization: Bearer not-a-real-token. The request returned public Constellation device metadata from a disposable fixture. A missing-header negative control returned …

The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons.

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("…") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is …

datamodel-code-generator is vulnerable to code injection when a developer passes an –extra-template-data file whose comment value contains a literal \r (carriage return). The comment variable is rendered into a Python # comment in six built-in templates with no line-terminator escaping. Python's tokenizer treats a bare CR as a physical-line terminator (see Python language reference — Physical lines), so the comment ends at the \r and the text after it is …

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "default_factory" key, its value is interpolated verbatim — as a raw Python expression — into the generated Field(default_factory=…) / field(default_factory=…) call. Because this assignment is evaluated at class-definition time (i.e. on import of the generated module), an attacker who controls the schema …

When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the –extra-template-data file and synthesises a Pydantic @field_validator(…) decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in unescaped single quotes. A value containing ' breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the …

datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial to bypass. An attacker who controls a JSON Schema fed to datamodel-codegen can therefore embed an arbitrary Python statement in the generated module, which executes at class-definition time …

@wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with –unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as ….//, could be transformed into ../ after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run wakaru –unpack on …

Novu's shared SSRF guard validateUrlSsrf(url) is used before server-side requests to user-configured URLs. The guard resolves hostnames and blocks a regex list of private/reserved IP ranges, but it does not block 100.64.0.0/10 shared address space. As a result, Novu features protected by this guard can still send server-side requests to destinations such as 100.100.100.200 (Alibaba Cloud metadata service) and any other service reachable in 100.64.0.0/10.

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. escapeValue() dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal and have the rest of the value parsed as SQL. Vector 1 - string parameters. Fixed in 2.0.2. The string branch escaped ' as '' …

Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants' /packages/<ns>/ …

It's possible to forge a request to delete a message.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code …

If the –write-link, –write-url-link or –write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or …

An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead to memory exhaustion.

Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/proto/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server.

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record() validation. record() intentionally filters proto, prototype, and constructor, but it still accepts other own keys that collide with inherited Object.prototype properties. If the record key schema or value schema rejects such an entry, Valibot creates an issue path containing that …

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the …

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the …

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service.

sm-crypto (npm package 0.4.0, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (src/sm2/utils.js: const rng = new SecureRandom()). SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from window.crypto.getRandomValues when available. In Node.js — sm-crypto's primary runtime — window is undefined, so the CSPRNG branch is skipped and the seed pool is instead filled from Math.random() (V8 xorshift128+, recoverable …

This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the …

This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. import { Shescape } from "shescape"; // 1. Prerequisites const options = { //flagProtection unspecified // Or flagProtection: true, }; // 2. Payload let payload = "\u0000-".repeat(32000); // 3. Usage const …

This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used …

This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways. import * as cp from …

A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side …

A pre-authentication denial-of-service panic in russh 0.62.2 (commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22). An unauthenticated client sends a single SSH_MSG_KEX_ECDH_INIT whose Q_C is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero peer public value, so server_dh() computes the all-zero shared secret and compute_exchange_hash() then calls encode_mpint(&shared.0, …), which indexes s[i] at i == s.len() and panics (index out of bounds: the len is 32 …

A post-authentication denial-of-service panic in russh 0.62.2 (commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22). An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed [(Pty::TTY_OP_END, 0); 130] array but increments its counter i for every valid record (logging "too many pty codes" without returning), then slices &modes[0..i] — an out-of-bounds slice that panics (range end index 131 out of …

A malicious SSH server can crash a russh client session with a single malformed key-exchange reply, causing a pre-authentication Denial-of-Service before the server host key is verified. The embedding process itself stays up, but the connection is killed deterministically.

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. [!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. [!NOTE] This only affects your application if you are using the unstable RSC APIs

ray.data.read_webdataset(paths=…) is a @PublicAPI(stability="alpha") reader for WebDataset-format TAR files. Its default decoder=True invokes _default_decoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled bytes with no validation: .pickle / .pkl -> pickle.loads(value) .pt / .pth -> torch.load(io.BytesIO(value), weights_only=False) Both fire during a standard ray.data.read_webdataset(…).take_all() / .iter_batches() call. No flags, no opt-in, no environment variable. An attacker who can supply a …

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers …

quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root. When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as proto, constructor, or prototype. This can allow attacker-controlled properties to be written to Object.prototype.

The b64 extension inlines images referenced by <img src="…"> as base64 data URIs. When resolving the src path it joins it onto the configured base_path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base_path. A src containing ../ sequences, or an absolute path, therefore reads a file outside base_path as long as that file has an allowed image extension (.png, .jpg, .jpeg, …

The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.

Preface Poweradmin maps OIDC identities into local users through oidc_user_links.oidc_subject plus provider_id. In the MySQL schema, the OIDC link table explicitly uses utf8mb4_unicode_ci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be matched byte-for-byte within the issuer/provider scope. The confirmed local PoC used two different OIDC users: Victim subject: victim-login Attacker subject: victím-login (í, U+00ED) MySQL reported those two subjects as equal under …