Skip to content
Loading...

Security Advisories

Vulnerabilities discovered by Talence Security through original research and responsible disclosure.

Severity:
Category:
Summary

The PipeWire RAOP (AirPlay) RTSP client fails to validate the Content-Length header value, allowing a malicious server to trigger a NULL pointer dereference and crash the PipeWire daemon.

References
Summary

The PipeWire PulseAudio-compatible server uses alloca() with an attacker-controlled size from incoming protocol messages without bounds checking, allowing a crafted message to cause a stack buffer overflow and crash the service.

References
Summary

An integer overflow in Apple HFS+ filesystem handling allows a crafted disk image to cause unexpected system termination. The integer overflow was addressed with improved input validation. Fixed in macOS Tahoe 26.6, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.

References
Summary

A buffer overflow in Apple MobileAccessoryUpdater allows a malicious accessory to cause unexpected app termination or potentially execute arbitrary code. The buffer overflow was addressed with improved bounds checking. Fixed in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.

References
Summary

arp/ip(6)t_register_table() adds the table to the per-netns list before allocating the per-netns hook ops copy via kmemdup_array(). A concurrent pernet exit finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference. Affected since 5.13, fixed in 7.0.11 and 7.1.

References
Summary

iptfs_destroy_state() calls hrtimer_cancel() while holding the xtsp->lock spinlock, but the hrtimer callback iptfs_delay_timer() also acquires xtsp->lock. If the timer is firing on another CPU, hrtimer_cancel() waits for the callback to complete while holding the lock the callback needs, creating an ABBA deadlock. Triggers under concurrent SA teardown and packet transmission.

References
Summary

The Nessus scanner daemon (nessusd) constructs SQL queries in the patches_summary.nbin NASL plugin using unsanitized hostname values via db_query() without parameterized binding. When reverse_lookup is enabled, an attacker controlling DNS PTR records for a scanned IP can inject SQL payloads that execute during scan processing, achieving second-order SQL injection and data exfiltration from the internal SQLite database (PASSWD, SETTINGS, PREFERENCES tables).

References
Summary

The Nessus scanner daemon (nessusd) stores hostnames from imported .nessus scan files via parameterized INSERT, but reads them back via snprintf string interpolation in the patches_summary.nbin NASL plugin without escaping. A crafted .nessus file with SQL injection payload in the ReportHost name field triggers second-order SQL injection when the imported results are processed, enabling data exfiltration from the internal SQLite database.

References
Summary

The WebSocket permessage-deflate extension does not limit the decompressed output size of incoming frames. A small compressed payload can expand to gigabytes, exhausting server memory and causing denial of service in any application using libsoup's WebSocket server (e.g. GNOME Online Accounts, Evolution, Flatpak).

References
Summary

The kpasswd service reads 6 bytes from the KRB-PRIV packet header without checking that the received packet is at least 6 bytes long. A 0-5 byte UDP packet causes a heap out-of-bounds read, potentially crashing the KDC process and disrupting Kerberos authentication for the domain.

References
Summary

The internal DNS server stores GSSAPI TKEY session keys in a fixed 128-entry ring buffer with no rate limiting or authentication requirement. An unauthenticated attacker sends 128 TKEY requests to flush all legitimate GSS-TSIG session keys, breaking authenticated DNS updates for the entire AD domain. Each request also allocates a GENSEC/KRB5 context for resource exhaustion. Co-discovery with Tridge.

References
Summary

The LDAP CompareRequest handler constructs a search filter by interpolating the comparison value without escaping LDAP metacharacters, and evaluates the resulting LDB search without calling ldb_req_mark_untrusted() (unlike all other LDAP operations). Authenticated users can inject filter syntax and use the Compare true/false oracle to extract protected attributes including password hashes and LAPS passwords. Co-discovery with OpenAI.

References
Summary

The xsltAttribute() function in libxslt frees a dictionary string via xmlDictOwns() check, but the pointer can alias an earlier dictionary entry still referenced by the attribute node. Processing a crafted XSLT stylesheet triggers a double-free of the dictionary-allocated string, corrupting the heap. Solo discovery.

References
Summary

The xsltParseTemplateContent() function in libxslt processes XSLT template nodes with incorrect type assumptions, allowing an attacker-controlled pointer dereference via a crafted XSLT stylesheet. This can lead to arbitrary code execution in the context of the rendering process. Solo discovery.

References
Summary

WebKit's Wasm Table and Global implementations do not retain transitive TypeDefinition references, allowing a use-after-free when a TypeDefinition is garbage collected while still referenced through a table or global indirection. Co-discovered with Kwak Kiyong and Song Nuri.

References
Summary

The MQTT v5 CONNECT decoder accesses will_prop before validating it is non-NULL when processing Will Property fields. A CONNECT packet with Will Flag set but missing Will Properties causes a NULL dereference crash. Pre-auth (CONNECT is the first MQTT packet). Co-discovery with tteoks.

References
Summary

p11-kit's attribute template parser allows unbounded recursion when processing nested CKA_WRAP_TEMPLATE/CKA_UNWRAP_TEMPLATE attributes. A crafted PKCS#11 object with deeply nested templates causes stack exhaustion, crashing any application linked against p11-kit (e.g. GnuTLS, NSS, OpenSC). Confirmed real security issue by maintainer.

References
Summary

The clean_metalink_string() function in Metalink URL parsing decrements a pointer past the start of the buffer when given an all-whitespace or trailing-whitespace URL. This causes a heap buffer underread that can crash wget or leak adjacent heap data. Fixed in commit 37a40fc with Reported-by credit. CVE pending via VulnCheck.

References
Summary

The parse_content_range() function uses signed integer arithmetic to parse Content-Range header values from HTTP server responses. A malicious server can supply values that cause signed integer overflow, leading to undefined behavior and incorrect range calculations. Fixed in commit 43d3ba9 with Reported-by credit. CVE pending via VulnCheck.

References
Summary

The convert_fname() function in wget's filename conversion logic mishandles the iconv E2BIG error case, leading to a heap buffer overflow when processing filenames that require character set conversion. A malicious HTTP server can trigger this by serving responses with filenames that expand during iconv conversion. Co-discovery with Arkadi Vainbrand. Fixed in commit dd692d9c with Reported-by credit. CVE pending via VulnCheck.

References
Summary

The html_quote_string() function uses an integer size counter that can overflow when processing very long strings with many characters requiring HTML entity escaping. The overflowed size is used to allocate a heap buffer that is too small, and the subsequent copy loop writes past the buffer boundary. Triggered in recursive mode with --convert-links. CVE pending via VulnCheck.

References
Summary

nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, bypassing the dst_entry refcount mechanism. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory, yielding a deterministic UAF-WRITE primitive in kmalloc-cg-256. Fully unprivileged via user namespace (unshare -Urn). Affects all kernels since v4.19 (2018). Working LPE exploit demonstrated on Ubuntu 24.04 and 26.04 with KASLR.

References
Summary

libssh2 through 1.11.1 has an out-of-bounds read in the SFTP READLINK/REALPATH response handler (sftp.c). The symlink_target buffer receives data without proper length validation, allowing a malicious SFTP server to trigger an OOB read. Independent co-discovery with Joshua Rogers. Fix: commit 2dae302/PR #1717. VulnCheck assigned CVE-2025-15661.

References
Summary

HAProxy through 3.1.17 has an integer overflow in the FCGI demultiplexer. The ignore_record function accumulates record length via drl += drp using uint16_t arithmetic, which wraps at 65535+1=0. When this occurs, zero bytes are consumed and the remaining buffer data is parsed as new FCGI records, enabling cross-stream response poisoning from a crafted FCGI backend.

References
Summary

HAProxy through 3.1.17 has a NULL pointer dereference in the HPACK dynamic header table. The hpack_dht_insert function at line 353 calls hpack_dht_defrag() for data-space defragmentation but does not check the return value for NULL. Two other call sites in the same function correctly check for NULL. Under memory pool exhaustion, this causes a worker process crash (denial of service).

References
Summary

The CSV ingestion tester endpoint does not validate target URLs against private IP ranges, allowing server-side request forgery with CSVMAPPERS capability. Co-discovery (duplicate).

References
Summary

The xrdp_rdp_process_data_control function in xrdp reads from the network stream without validating that sufficient data remains for the control PDU fields. A malicious RDP client can send a truncated Client Request Control PDU that triggers out-of-bounds reads. Pre-authentication, within the MCS userData buffer. GHSA-3m4m-h22g-c7xx.

References
Summary

The xrdp_sec_process_mcs_data_CS_SECURITY function in xrdp reads security data fields from the GCC Conference Create Request without validating that the stream contains enough bytes. A malicious RDP client can send a truncated CS_SECURITY block that triggers out-of-bounds reads. Pre-authentication. GHSA-6g36-mxcf-r3gc.

References
Summary

nilfs-utils through 2.3.0 does not validate the s_log_block_size field from NILFS2 filesystem superblocks. A crafted filesystem image with a large s_log_block_size value causes undefined behavior via excessive left-shift and subsequent out-of-memory conditions. Fix: PR #27 (commit 26efb5d).

References
Summary

The SOCKS5 reply parser in socat uses a signed char variable to store the address length byte from the SOCKS5 server response. When the server sends a value >= 128, the signed char becomes negative, bypassing the buffer size check. The negative value is then implicitly promoted to a large unsigned value in the subsequent recv() call, causing a heap buffer overflow. A malicious SOCKS5 proxy server can exploit this to crash the socat process or potentially achieve code execution. Fixed in socat 1.8.1.2.

References
Summary

The FIPS security header parsing in xrdp_sec_recv_fastpath() and xrdp_sec_recv() reads a pad value from the client-supplied TS_FP_FIPS_INFO structure and subtracts it from the stream end pointer without validating that pad is within the valid range (0-7 for DES3-CBC). A pad value larger than the remaining data causes a pointer underflow, producing a negative length cast to size_t in the HMAC signature verification, triggering a massive heap out-of-bounds read and crash. Pre-auth, requires crypt_level=fips. Co-discovered with Tencent Xuanwu Lab.

References
Summary

Evil-WinRM through version 3.9 has a path traversal vulnerability in the download_dir() function. A malicious SMB server or compromised Windows host can serve file paths containing directory traversal sequences (../) that write files outside the intended download directory on the attacker's machine. Fix: PR #81.

References
Summary

The xrdp_rdp_recv() function processes RDP PDUs in a loop, advancing the stream position by totalLength bytes per iteration. When totalLength is 0, the stream position never advances and xrdp enters an infinite loop, consuming 100% CPU on that connection's forked process. Pre-auth, no credentials needed. GHSA-9j3q-9mvw-qv7j accepted.

References
Summary

The psd (print sessions dump) CLI command in coturn takes a filename argument and directly passes it to fopen(cmd, "w") with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process. The file is truncated and overwritten with session dump data, whose content can be partially influenced by creating TURN allocations with crafted usernames. The CLI admin interface requires password authentication and binds to localhost by default.

References
Summary

In notify_user_response(), the check 'if (big_resp)' is inverted -- should be 'if (!big_resp)'. On successful aa_get_buffer() allocation, the function returns -ENOMEM and leaks the buffer. On failure, big_resp is NULL and execution continues with a NULL dereference. Additionally, the stack variable &uresp is always passed to the handler instead of big_resp, so the entire large-response code path is non-functional. An unprivileged local user can trigger the memory leak, leading to resource exhaustion. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

After kstrdup() allocates glob, the code checks 'if (!name)' instead of 'if (!glob)'. Since name is never NULL at that point, a kstrdup failure stores glob=NULL as clone->data.name, leading to a NULL pointer dereference on subsequent access. An unprivileged local user can trigger this to cause a kernel oops. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

In the TAILGLOB notification response path, kfree(name) is called on a pointer into the stack-allocated uresp union instead of the kstrdup'd glob pointer. This attempts to free a non-kmalloc'd address, corrupting slab metadata. Meanwhile the actual heap allocation (glob) is leaked. An unprivileged local user can trigger this to corrupt kernel memory. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The response_is_valid_name() function returns -EMSGSIZE or -EINVAL on validation failures instead of false. Since the return type is bool, (bool)(-EINVAL) = true, so every validation check passes. This allows notification responses with invalid sizes, out-of-bounds offsets, or incorrect flags to be accepted and processed as if well-formed. An unprivileged local user can send crafted responses to bypass all name validation. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

In knotif_update_from_uresp_perm(), the variable 'flags' is declared but not initialized in the else branch when uresp is NULL. The subsequent check 'if (!(flags & URESPONSE_NO_CACHE))' reads an uninitialized stack value, causing nondeterministic notification response caching behavior. An unprivileged local user can trigger incorrect caching of AppArmor notification responses. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The knotif_update_from_uresp_name() function modifies the profile->rules linked list via list_add_tail_entry() without holding any lock. This list is concurrently walked during file access mediation (aa_file_perm path). The source code contains a TODO comment acknowledging the missing lock. Concurrent modification and traversal causes list corruption, which can lead to use-after-free when a corrupted list entry is freed while another thread holds a stale pointer. An unprivileged local user can trigger the race condition to cause memory corruption and, theoretically, arbitrary code execution (local privilege escalation). Affects Ubuntu 24.04 (6.8) only. Rated HIGH by Canonical. Fixed in USN-8373-1 (6.8.0-124.124).

References
Summary

sizeof(unotif) evaluates to 8 bytes (pointer size on x86_64) instead of sizeof(*unotif) (the actual struct size). This allows kzalloc(size) to be called with a size between 8 and the struct size, and subsequent access to struct fields beyond the allocation causes a slab-out-of-bounds read. KASAN confirmed: 2-minute fuzzer reproduces reliably. Information disclosure from adjacent slab objects. An unprivileged local user can trigger this via the notification interface. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The DFA unpack length calculation 'size - ((void *)unotif - pos)' expands to 'size + filter' instead of 'size - filter', giving the DFA parser access to up to 2*filter bytes past the buffer end. Invalid data from adjacent slab objects is fed into the AppArmor DFA policy engine, which can result in incorrect access control decisions. An unprivileged local user can exploit this to bypass AppArmor security policies. Rated HIGH by Canonical: 'can allow a local user to bypass security measures'. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

knotif_update_from_uresp_name() is called under listener->lock (spinlock) but performs sleeping operations: kzalloc(GFP_KERNEL), kstrdup(GFP_KERNEL), and aa_lookup_profile() (may acquire mutex). This triggers 'BUG: scheduling while atomic' on debug kernels and causes deadlocks on production kernels. An unprivileged local user can trigger kernel panic or deadlock. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

aa_new_ruleset() calls INIT_LIST_HEAD(&rules->list) without checking the kzalloc() return value. On memory allocation failure (especially likely under GFP_KERNEL-under-spinlock from CVE-2026-47334), this dereferences NULL and causes a kernel panic. Chains with CVE-2026-47334 (sleep under spinlock forces GFP_ATOMIC behavior, increasing OOM probability). An unprivileged local user can trigger this to cause a kernel panic. Affects Ubuntu 24.04 (6.8) only. Fixed in USN-8373-1.

References
Summary

In profile_opt_perm(), the variable declaration '__be16 l = htons(l)' reads l before initialization. The intention was htons(level) using the function parameter. Instead, l reads garbage from the stack and uses it for the DFA permission lookup, making all fine-grained sockopt mediation non-functional on Ubuntu 24.04. Policies restricting specific sockopt levels neither correctly allow nor correctly deny. An unprivileged local user can influence fine-grained network socket mediation. Affects Ubuntu 24.04 (6.8) only. Fixed in USN-8373-1.

References
Summary

In bind_map_addr(), addr4 is initialized to NULL. When sa_family is AF_UNSPEC and sk_family is PF_INET, the code reads addr4->sin_addr.s_addr while addr4 is still NULL (the assignment happens after the fallthrough to case AF_INET). This dereferences address 0x4, causing a kernel oops. Triggered when any AppArmor-confined application (snap, Docker, LXD) calls bind() with AF_UNSPEC on an IPv4 socket. Co-discovered independently by Trevor Lawrence. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

Multiple capability set processing functions in xrdp read from the network stream without validating that sufficient data remains. The S_CHECK_REM macro is a no-op in production builds (only active with --enable-devel-streamcheck). When a malicious RDP client sends capability sets with lengthCapability=4 (header only, zero data bytes), handlers read 2-8 bytes past the declared boundary. Pre-auth, within the 16KB MCS userData buffer. GHSA-mwrh-rwqc-xwhx accepted.

References
Summary

The coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without any sanitization. The is_secure_string() filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations. Three injection vectors exist in turn_admin_server.c, each flowing through dbd_pgsql.c snprintf patterns into PQexec() which supports stacked queries. An authenticated admin can inject arbitrary SQL, gaining full database control and potentially OS-level access via PostgreSQL's COPY TO PROGRAM. The --web-admin flag must be enabled (disabled by default).

References
Summary

The radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack via memcpy with rinfo->nd_opt_ri_len as the size control, overflowing by up to 2016 bytes. Pre-authentication, network-adjacent attack vector (Layer 2). The nd_opt_ri_len field is an 8-bit value from the wire packet, and when greater than 1, the copy size is (nd_opt_ri_len - 1) * 8 bytes with no upper bound check.

References
Summary

The Terrascan server mode scan endpoints accept a webhook_url parameter (form field on file/scan, JSON field on remote/dir/scan, query param on k8s webhook validate). The user-controlled URL flows to executor.go -> webhook.Webhook{URL} -> SendPOSTRequest() which makes an HTTP POST with scan results to the attacker-specified URL. The HTTP client retries 10 times and follows redirects. No URL validation is performed anywhere in the code path. Product archived August 2023.

References
Summary

The remote/dir/scan endpoint accepts a remote_url JSON field passed to hashicorp/go-getter v1.7.5 DownloadWithType() with http remote type. go-getter HttpGetter fetches the URL and supports X-Terraform-Get redirect headers that can chain to file:// URLs via the registered FileGetter. The Netrc option is enabled, which can leak credentials. No URL validation or scheme restrictions are applied. Product archived August 2023.

References
Summary

ARM template templateLink.uri and parametersLink.uri fields, as well as CloudFormation AWS::CloudFormation::Stack TemplateURL fields, are fetched via go-getter with all detectors enabled including FileDetector, allowing direct file:// URL access. Both are triggered by uploading crafted IaC files to the unauthenticated file scan endpoint. Product archived August 2023.

References
Summary

Box_stts::get_sample_duration() and Box_ctts::get_sample_offset() in seq_boxes.cc contain while loops that never increment the index variable. A crafted HEIF/AVIF sequence file with a stts entry where sample_count is 0 triggers an infinite loop in init_sample_timing_table(), causing 100% CPU denial of service on any application using libheif for sequence decoding. The consistency check passes because 0 + N = N. Fixed on master (723b58d6) but not in v1.21.2 (latest release at time of discovery).

References
Summary

Seven Hydra protocol modules (SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, HTTP-Proxy-Urlenum) build an NTLM Type-3 response from a server-supplied Type-2 challenge, base64-encode it into a 4096-byte intermediate buffer, then copy it into a 500-byte stack buffer via sprintf without a length check. A malicious server sending a crafted NTLM Type-2 challenge with a long domain string (up to 127 Unicode characters after truncation in ntlm.c) causes the base64-encoded response to exceed 500 bytes, overflowing the stack buffer by 18 to 330 bytes with partially attacker-controlled data. On default builds with FORTIFY_SOURCE, the process is terminated; on builds without stack protector, this enables code execution on the pentester's machine. Fix: commit 9cc84c20e7 (2026-05-19).

References
Summary

Use-after-free in JavaScriptCore's DFG/FTL JIT compiler. The GetIndexedPropertyStorage constant folding phase bakes a raw storage pointer (view->vector()) as a ConstantStoragePointer for TypedArray views on WebAssembly resizable buffers. The associated watchpoint only fires on buffer detach, not on resizable buffer grow. When memory.grow() reallocates the backing store in BoundsChecking mode, JIT-compiled code continues reading and writing through the stale pointer to freed memory. Exploitation yields a heap read/write primitive from web content without flags or user interaction beyond navigation. No cage in JSC means the primitive leads directly to renderer code execution. Patched in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5, visionOS 26.5 (May 11, 2026). WebKit Bugzilla 310207.

References
Summary

task_set_tokens() writes 40-byte task_token_ro_data via non-atomic memcpy into a read-only zone. Concurrent lock-free readers (ipc_kmsg.c, task_is_privileged) observe torn/inconsistent identity data. CVE-2025-24118 fix addressed p_ucred but missed task_tokens. Affects all architectures (x86_64, ARM64 SPTM, ARM64 PPL). An app may be able to cause unexpected system termination. Co-discovered.

References
Summary

Heap out-of-bounds read (4 bytes) in VLAN decapsulation memmove in lldpd.c. When a received frame size equals the MTU allocation, the memmove length argument is 4 bytes too large, reading past the heap buffer. Pre-authentication, Layer 2 adjacent attack vector. Fix merged.

References
Summary

sl_unpack() discards the buffer length parameter (ibuflen), leaving all sl_unpack_* functions to use attacker-controlled count and offset values without bounds checking. The toc_entries field is computed but never validated (dead code), and toc_index values are unbounded. An authenticated AFP user with Spotlight access can trigger reads up to 64KB past the server_quantum allocation. Co-discovered (our report selected as primary). GHSA-wq5m-vg8f-w65f.

References
Summary

afp_setfilparams reads file contents as a symlink target when FinderInfo matches the 'slnkrhap' magic without validating the target path. No absolute path check, no directory traversal check, and no volume boundary check are performed. An authenticated user can create symlinks pointing anywhere on the filesystem, enabling cross-protocol exploitation via Samba, NFS, or backup daemons that follow symlinks. Co-discovered (our report selected as primary). CVSS raised to 8.1 by maintainer. GHSA-fxgp-28q4-5cwx.

References
Summary

The Express Entry Detail block's action_view_express_entity() method allows any unauthenticated visitor to access arbitrary Express entries by enumerating auto-increment integer IDs in the URL. The method fetches entries directly by ID without performing any permission check, bypassing the canViewExpressEntry() authorization enforced everywhere else. Express entries commonly contain form submissions (contact forms, support requests, surveys), making this a direct path to PII disclosure. Fixed in 9.5.1.

References
Summary

The message_detail conversation frontend endpoint allows unauthenticated users to read any conversation message by providing sequential integer message IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1. Independent co-discovery.

References
Summary

The message_page conversation frontend endpoint allows unauthenticated users to enumerate conversation messages by providing sequential integer conversation IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1.

References
Summary

The get_rating conversation frontend endpoint allows unauthenticated users to retrieve conversation message ratings by providing sequential integer message IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1.

References
Summary

The AddMessage and UpdateMessage conversation controllers accept user-supplied file attachment IDs and load files directly via EntityManager::find() without checking per-file permissions (canViewFile). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, bypassing the file permission system. Fixed in 9.5.1.

References
Summary

The conversation DeleteFile controller has an inverted CSRF token validation condition. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing, effectively disabling CSRF protection for the file deletion endpoint. Fixed in 9.5.1.

References
Summary

The default Authorizer function in GoFiber's BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. With bcrypt-hashed passwords, the timing difference between a valid and invalid username is approximately 1,000,000:1 (~100ms vs ~100ns), enabling reliable remote username enumeration. GHSA-g5vh-55hw-rxm8.

References
Summary

The BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header use the attacker's spoofed IP for logging, rate limiting, and access control. GHSA-gcfq-8gqf-4876.

References
Summary

The MySQL CNID backend constructs SQL queries via asprintf() string interpolation of AFP filenames without escaping. Three functions (cnid_mysql_add, cnid_mysql_get, cnid_mysql_find) pass user-controlled filenames directly into SQL strings, enabling full SQL injection for any authenticated AFP user. The entire module contains only one mysql_real_escape_string() call, and it is for a binary stamp blob, not for filenames. Co-discovered. GHSA-627q-6pww-j6x4.

References
Summary

dsi_writeinit() computes the data payload size as ntohl(dsi_len) - dsi_doff using unsigned 32-bit arithmetic with no validation that dsi_len >= dsi_doff. When dsi_doff exceeds dsi_len, the subtraction wraps to near UINT32_MAX (~4GB), causing dsi_writeflush() to enter an infinite socket read loop (pre-auth DoS via desync chain) or ad_recvfile to splice ~4GB to disk (post-auth disk fill). Co-discovered (our report selected as primary). GHSA-p8cw-m237-6w2c.

References
Summary

Tinyproxy through 1.11.2 is vulnerable to HTTP request smuggling via Content-Length / Transfer-Encoding desynchronization. When both headers are present in a request, Tinyproxy processes one while forwarding both to the backend, allowing an attacker to smuggle requests. Fix: PR #610 (commit ff45d3b).

References
Summary

Tinyproxy through 1.11.2 accepts HTTP requests with duplicate Content-Length headers containing different values. It uses one value for its own processing while forwarding both to the backend server, enabling HTTP request smuggling. Fix: PR #610 (commit 6ed6fc9).

References
Summary

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to view attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files. The function file_can_view_bugnote_attachments() does not pass the bugnote ID to file_can_view_or_download(), skipping the private bugnote visibility check entirely. The download path is correctly protected, but the view/content path is not.

References
Summary

The mc_issue_update() function in MantisBT allows users with UPDATER (level 40) access to edit, change view state, and modify time tracking on bugnotes belonging to other users, bypassing the DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. The issue update endpoint checks only update_bug_threshold before processing note modifications, with no per-note authorization check. This affects both the SOAP and REST API endpoints.

References
Summary

MantisBT's textarea custom field input function echoes user-supplied values without HTML encoding, allowing a textarea breakout and arbitrary HTML injection. The function cfdef_input_textarea() outputs the raw custom field value into a textarea element without htmlspecialchars(). Every other textarea in MantisBT uses string_textarea() for encoding, making this the sole omission. Default CSP blocks JavaScript execution, but CSS injection and HTML phishing remain exploitable.

References
Summary

The AJP message header validation in ajp_msg_check_header() uses an incorrect boundary check (> instead of >=), allowing a malicious or compromised AJP backend to send a response whose body length equals max_size. Since the 4-byte AJP header is already stored at the start of the buffer, the body write overflows the heap-allocated buffer by exactly 4 bytes with attacker-controlled content. The AJP secret directive does not protect against this because it only authenticates requests from Apache to the backend, not responses. Co-discovered independently, CVE-2026-28780 assigned by Apache Security Team.

References
Summary

The NTLM proxy authentication handler contains a stack-based off-by-one buffer overflow when processing proxy challenge responses. A malicious proxy server can trigger a 1-byte out-of-bounds write on the stack. NTLM authentication has been removed from the post-2.7 codebase. Fix confirmed by vendor, credit as Reported-by: Tristan Madani (@TristanInSec).

References
Summary

ERB's deserialization guard (@_init check) only protects ERB#result and ERB#run, but three other methods (def_method, def_module, def_class) evaluate @src via module_eval without the guard. An attacker crafts a malicious ERB object with @src beginning with 'end' to break out of the wrapping method definition, then calls def_module() (zero-argument, ideal gadget) to achieve immediate code execution during module evaluation. Combined with ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy, this creates a complete RCE chain triggered by Marshal.load on untrusted data, affecting Rails applications and any Ruby tool deserializing untrusted objects.

References
Summary

The lib_palette_update() function in xrdp's VNC backend processes RFB SetColourMapEntries messages without validating the first_color field against the palette[256] array bounds. A malicious VNC server can send first_color values up to 65535, causing attacker-controlled 24-bit values to be written at offsets up to 262,140 bytes past the palette array in the heap-allocated vnc struct. This overwrites adjacent struct fields including the trans pointer (which contains function pointers), providing a direct path to remote code execution. Co-discovered with Tencent Xuanwu Lab.

References
Summary

The lib_framebuffer_update() function computes pixel buffer size as cx * cy * bytes_per_pixel using signed 32-bit integer arithmetic. Since cx and cy are 16-bit values from the VNC server, the multiplication can overflow, producing a small positive value that causes an undersized heap allocation. The buffer is then passed to server_paint_rect with the original dimensions, causing xrdp_painter_copy to read up to 786 KB of heap memory past the allocated buffer. The leaked data is encoded and sent back to the attacker's RDP client, enabling ASLR bypass and credential theft. Co-discovered with Tencent Xuanwu Lab.

References
Summary

The WebCodecs ImageDecoder implementation creates MozPromise callback chains for metadata decode, frame count, and frame decode operations without calling Track() to store request handles. Unlike the sibling DecoderTemplate used by VideoDecoder, AudioDecoder, VideoEncoder, and AudioEncoder, ImageDecoder lacks request tracking entirely. After the Cycle Collector UNLINKs the decoder, mCompletePromise is set to nullptr, but Destroy() does not set mClosed or mComplete to true. The orphaned callback fires, enters OnMetadataFailed which sees mClosed == false, calls Close() which sees mComplete == false, and dereferences the null mCompletePromise pointer. The developer confirmed additional lifetime problems in Reset() and ProcessControlMessageQueue(). Affects Firefox 149 and 150. Fixed in Firefox 151, with uplift tracking for Firefox 150 and ESR 140.

References
Summary

The OPNsense authentication system passes login usernames directly into LDAP search filters via string interpolation without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters through the login form, Captive Portal (CORS: *), or OpenVPN authentication to enumerate directory users and probe attributes. Additionally, the LDAP authenticator overrides Base::authenticate() to bypass the 2-second constant-time timing normalization, creating a reliable timing side-channel for user enumeration. Independently discovered; CVE-2026-34578 was assigned to Matt Andreko who reported the same vulnerability a few days earlier.

References
Summary

The SSH_MSG_EXT_INFO handler in libssh2 through 1.11.1 does not validate return values from _libssh2_get_string() when parsing extension info messages. A malicious SSH server can send a crafted EXT_INFO message that causes CPU exhaustion or denial of service during the pre-authentication phase. Fix: PR #1864.

References
Summary

libssh2 through 1.11.1 has an integer overflow in the chacha20-poly1305 transport handler (transport.c) when processing packet_length on 32-bit platforms. An unchecked packet_length value leads to a heap buffer overflow during decryption. A malicious SSH server or MITM attacker can trigger this to achieve remote code execution.

References
Summary

On 32-bit platforms, decoding a WebP image whose VP8X header declares a canvas size (width × height) that overflows int32 returns a corrupt Image whose subsequent access panics the program. RFC 9649 §2.7 caps canvas size at 2^32 − 1 pixels, but the decoder neither rejects oversized canvases nor avoids constructing a malformed image, exposing any 32-bit Go service that decodes untrusted WebP input to a remote denial of service. Designated PUBLIC track by the Go security team.

References
Summary

An authenticated user can create a public mock server whose response headers and body are fully user-controlled. By setting Content-Type: text/html and a JavaScript payload in the response body, the attacker achieves stored XSS on the backend origin. Since mock URLs share the same origin as the API and authentication cookies are httpOnly/sameSite:lax, the XSS executes with the victim's session context — enabling account takeover, admin escalation, and full data exfiltration via authenticated GraphQL calls. Co-discovered.

References
Summary

The reports_form_save() function accepts the format_file parameter via get_nfilter_request_var() (zero filtering) and stores it directly in the database. When the report is generated, reports_load_format_file() concatenates this value into a file path without path traversal validation. An authenticated user with Reports permission (realm 21) can read arbitrary server files including include/config.php (database credentials) by supplying a traversal payload such as ../include/config.php.

References
Summary

The IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of any issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID with Issue.objects.filter(id__in=issue_ids) without filtering by workspace or project, breaking tenant isolation in multi-workspace deployments.

References
Summary

The SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to Django's F() expression without validation, unlike the regular AnalyticsEndpoint which validates against an allowlist. An authenticated workspace member can extract values from any related database field — including workspace__owner__password (bcrypt hashes), API tokens, and email addresses — by abusing Django's field reference resolution in annotated queries.

References
Summary

The fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 (xattr: switch to CLASS(fd)).

References
Summary

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.

References
Summary

In the Linux kernel 5.3.10, there is a use-after-free in the perf_trace_lock_acquire function, related to include/trace/events/lock.h.

References
Summary

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert(). A crafted packet can trigger an out-of-bounds read, potentially leaking process memory or crashing the application. Independently co-discovered and reported before public disclosure.

References
Summary

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). A crafted Babel routing protocol packet can trigger an out-of-bounds heap read, potentially leaking process memory or causing a denial of service. Independently co-discovered and reported before public disclosure.

References
Summary

The Google Doc Embedder plugin (90,000+ active installs) lacks CSRF protection on its profile settings forms (options-general.php?page=gde-settings). An attacker can forge requests that create, edit, or delete embed profiles — including changing the file base URL, viewer permissions, and profile metadata — when an authenticated admin visits a malicious page. The CSRF can be chained with the plugin's stored XSS in the description field to plant persistent payloads.

References
Summary

The Google Doc Embedder plugin (90,000+ active installs) renders the profile description field without sanitization in tab-profiles.php (the value is passed through _e() rather than esc_html()). An authenticated user with access to the plugin's settings can store a payload that executes whenever any admin views the embed profiles list.

References

108 Advisories Published