Skip to content
Loading...

Security Advisories

Vulnerabilities discovered by Talence Security through original research and responsible disclosure.

Severity:
Category:
Summary

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside the valid range but does not return early. The unchecked value feeds TID_WINDOW_SZ() to compute a kzalloc size and is stored in rxtid->hold_q_sz, producing zero-size or overflowed allocations. Subsequent access through hold_q[] writes out of bounds on the heap. A malicious or compromised access point can trigger this via crafted ADDBA response frames.

References
Summary

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the WMI event buffer length. Their sum (up to 765 bytes via three u8 fields) can exceed the actual data, causing out-of-bounds heap reads during IE parsing and corrupting wmi->is_wmm_enabled state. A malicious access point can trigger this via crafted association frames relayed by the firmware.

References
Summary

The firmware-controlled num_msg field (u8, range 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. When the firmware sends an inflated num_msg, the loop reads up to 1020 bytes of heap data past the WMI event buffer boundary via the variable-length tx_complete_msg_v1 array.

References
Summary

Use-after-free in gfs2_qd_dealloc() (fs/gfs2/quota.c) where the superblock pointer (sdp) is dereferenced after the quota data (qd) structure has been freed in an RCU callback. The qd->qd_gl->gl_name.ln_sbd path follows a dangling pointer because the glock (qd_gl) may already be destroyed after qd is freed, producing a heap use-after-free read that can leak kernel memory or cause a crash (CWE-416). Triggered during GFS2 filesystem unmount with active quotas.

References
Summary

The REST v4 API JSON handler reads request data from $GLOBALS['RAW_REQUEST'], an unsanitized copy of $_REQUEST saved before the global securexss() filter runs. The set_relationship API method passes user-controlled relationship field values through to SugarRelationship::addRow() and updateRow(), which interpolate values directly into SQL INSERT and UPDATE statements without escaping. An authenticated user can inject arbitrary SQL via relationship fields like contact_role on the opportunities_contacts table, achieving full database compromise.

References
Summary

The Courier IMAP server's MIME parser processes nested multipart MIME structures without depth limiting, allowing a crafted email to trigger unbounded recursion and crash the server via stack overflow.

References
Summary

The PipeWire RAOP (AirPlay) RTSP client fails to validate the Content-Length header value, allowing a malicious server to trigger a NULL pointer dereference and crash the PipeWire daemon.

References
Summary

The PipeWire PulseAudio-compatible server uses alloca() with an attacker-controlled size from incoming protocol messages without bounds checking, allowing a crafted message to cause a stack buffer overflow and crash the service.

References
Summary

An integer overflow in Apple HFS+ filesystem handling allows a crafted disk image to cause unexpected system termination. The integer overflow was addressed with improved input validation. Fixed in macOS Tahoe 26.6, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.

References
Summary

A buffer overflow in Apple MobileAccessoryUpdater allows a malicious accessory to cause unexpected app termination or potentially execute arbitrary code. The buffer overflow was addressed with improved bounds checking. Fixed in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.

References
Summary

arp/ip(6)t_register_table() adds the table to the per-netns list before allocating the per-netns hook ops copy via kmemdup_array(). A concurrent pernet exit finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference. Affected since 5.13, fixed in 7.0.11 and 7.1.

References
Summary

iptfs_destroy_state() calls hrtimer_cancel() while holding the xtsp->lock spinlock, but the hrtimer callback iptfs_delay_timer() also acquires xtsp->lock. If the timer is firing on another CPU, hrtimer_cancel() waits for the callback to complete while holding the lock the callback needs, creating an ABBA deadlock. Triggers under concurrent SA teardown and packet transmission.

References
Summary

The readdir_long_name() function in the libssh SFTP server uses strcat to append a filename into a fixed 350-byte stack buffer without checking the total length. When listing files from an attacker-controlled directory (e.g., via FUSE or a network filesystem), a long filename overflows the buffer. The attacker controls both the overflow length and content (filename bytes), making this a code execution primitive, not just a denial-of-service.

References
Summary

The Nessus scanner daemon (nessusd) constructs SQL queries in the patches_summary.nbin NASL plugin using unsanitized hostname values via db_query() without parameterized binding. When reverse_lookup is enabled, an attacker controlling DNS PTR records for a scanned IP can inject SQL payloads that execute during scan processing, achieving second-order SQL injection and data exfiltration from the internal SQLite database (PASSWD, SETTINGS, PREFERENCES tables).

References
Summary

The Nessus scanner daemon (nessusd) stores hostnames from imported .nessus scan files via parameterized INSERT, but reads them back via snprintf string interpolation in the patches_summary.nbin NASL plugin without escaping. A crafted .nessus file with SQL injection payload in the ReportHost name field triggers second-order SQL injection when the imported results are processed, enabling data exfiltration from the internal SQLite database.

References
Summary

The WebSocket permessage-deflate extension does not limit the decompressed output size of incoming frames. A small compressed payload can expand to gigabytes, exhausting server memory and causing denial of service in any application using libsoup's WebSocket server (e.g. GNOME Online Accounts, Evolution, Flatpak).

References
Summary

The kpasswd service reads 6 bytes from the KRB-PRIV packet header without checking that the received packet is at least 6 bytes long. A 0-5 byte UDP packet causes a heap out-of-bounds read, potentially crashing the KDC process and disrupting Kerberos authentication for the domain.

References
Summary

The CTDB daemon trusts client-supplied packet length fields in the ctdb_req_header without validating them against the actual received data size. A crafted CTDB packet with inflated length fields causes heap out-of-bounds reads when processing request data, potentially leaking adjacent heap memory or crashing ctdbd.

References
Summary

The LDAP CompareRequest handler constructs a search filter by interpolating the comparison value without escaping LDAP metacharacters, and evaluates the resulting LDB search without calling ldb_req_mark_untrusted() (unlike all other LDAP operations). Authenticated users can inject filter syntax and use the Compare true/false oracle to extract protected attributes including password hashes and LAPS passwords. Co-discovery with OpenAI.

References
Summary

The internal DNS server stores GSSAPI TKEY session keys in a fixed 128-entry ring buffer with no rate limiting or authentication requirement. An unauthenticated attacker sends 128 TKEY requests to flush all legitimate GSS-TSIG session keys, breaking authenticated DNS updates for the entire AD domain. Each request also allocates a GENSEC/KRB5 context for resource exhaustion. Co-discovery with Tridge.

References
Summary

The xsltAttribute() function in libxslt frees a dictionary string via xmlDictOwns() check, but the pointer can alias an earlier dictionary entry still referenced by the attribute node. Processing a crafted XSLT stylesheet triggers a double-free of the dictionary-allocated string, corrupting the heap.

References
Summary

The xsltParseTemplateContent() function in libxslt processes XSLT template nodes with incorrect type assumptions, allowing an attacker-controlled pointer dereference via a crafted XSLT stylesheet. This can lead to arbitrary code execution in the context of the rendering process.

References
Summary

WebKit's Wasm Table and Global implementations do not retain transitive TypeDefinition references, allowing a use-after-free when a TypeDefinition is garbage collected while still referenced through a table or global indirection. Co-discovered with Kwak Kiyong and Song Nuri.

References
Summary

The _remote_debugging module's binary profiling file reader (binary_io_reader.c) contains integer overflow vulnerabilities in decode_stack_pop_push() and decode_stack_suffix(). Both compute size_t final_depth = keep + push from attacker-controlled varint-encoded values in a crafted .pyb file. On 32-bit platforms, the addition wraps around (e.g. 0x100 + 0xFFFFFF00 = 0), bypassing the capacity check. The subsequent memmove() writes 1024 bytes of attacker-controlled data to an attacker-controlled heap offset, overwriting adjacent heap objects. On 32-bit targets, this achieves arbitrary heap corruption and can lead to remote code execution. 64-bit platforms are not affected (no wrap). Fixed before 3.15.0 stable release (no CVE assigned, pre-release only).

References
Summary

The MQTT v5 CONNECT decoder accesses will_prop before validating it is non-NULL when processing Will Property fields. A CONNECT packet with Will Flag set but missing Will Properties causes a NULL dereference crash. Pre-auth (CONNECT is the first MQTT packet). Co-discovery with tteoks.

References
Summary

p11-kit's attribute template parser allows unbounded recursion when processing nested CKA_WRAP_TEMPLATE/CKA_UNWRAP_TEMPLATE attributes. A crafted PKCS#11 object with deeply nested templates causes stack exhaustion, crashing any application linked against p11-kit (e.g. GnuTLS, NSS, OpenSC).

References
Summary

The clean_metalink_string() function in Metalink URL parsing decrements a pointer past the start of the buffer when given an all-whitespace or trailing-whitespace URL. This causes a heap buffer underread that can crash wget or leak adjacent heap data. Fixed in commit 37a40fc.

References
Summary

The parse_content_range() function uses signed integer arithmetic to parse Content-Range header values from HTTP server responses. A malicious server can supply values that cause signed integer overflow, leading to undefined behavior and incorrect range calculations. Fixed in commit 43d3ba9.

References
Summary

The convert_fname() function in wget's filename conversion logic mishandles the iconv E2BIG error case, leading to a heap buffer overflow when processing filenames that require character set conversion. A malicious HTTP server can trigger this by serving responses with filenames that expand during iconv conversion. Co-discovery with Arkadi Vainbrand. Fixed in commit dd692d9c.

References
Summary

The html_quote_string() function uses an integer size counter that can overflow when processing very long strings with many characters requiring HTML entity escaping. The overflowed size is used to allocate a heap buffer that is too small, and the subsequent copy loop writes past the buffer boundary. Triggered in recursive mode with --convert-links.

References
Summary

nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, bypassing the dst_entry refcount mechanism. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory, yielding a deterministic UAF-WRITE primitive in kmalloc-cg-256. Fully unprivileged via user namespace (unshare -Urn). Affects all kernels since v4.19 (2018). Working LPE exploit demonstrated on Ubuntu 24.04 and 26.04 with KASLR.

References
Summary

libssh2 through 1.11.1 has an out-of-bounds read in the SFTP READLINK/REALPATH response handler (sftp.c). The symlink_target buffer receives data without proper length validation, allowing a malicious SFTP server to trigger an OOB read. Independent co-discovery with Joshua Rogers. Fix: commit 2dae302/PR #1717.

References
Summary

HAProxy through 3.1.17 has an integer overflow in the FCGI demultiplexer. The ignore_record function accumulates record length via drl += drp using uint16_t arithmetic, which wraps at 65535+1=0. When this occurs, zero bytes are consumed and the remaining buffer data is parsed as new FCGI records, enabling cross-stream response poisoning from a crafted FCGI backend.

References
Summary

HAProxy through 3.1.17 has a NULL pointer dereference in the HPACK dynamic header table. The hpack_dht_insert function at line 353 calls hpack_dht_defrag() for data-space defragmentation but does not check the return value for NULL. Two other call sites in the same function correctly check for NULL. Under memory pool exhaustion, this causes a worker process crash (denial of service).

References
Summary

The CSV ingestion tester endpoint does not validate target URLs against private IP ranges, allowing server-side request forgery with CSVMAPPERS capability. Co-discovered.

References
Summary

The xrdp_rdp_process_data_control function in xrdp reads from the network stream without validating that sufficient data remains for the control PDU fields. A malicious RDP client can send a truncated Client Request Control PDU that triggers out-of-bounds reads. Pre-authentication, within the MCS userData buffer.

References
Summary

The xrdp_sec_process_mcs_data_CS_SECURITY function in xrdp reads security data fields from the GCC Conference Create Request without validating that the stream contains enough bytes. A malicious RDP client can send a truncated CS_SECURITY block that triggers out-of-bounds reads. Pre-authentication.

References
Summary

Integer overflow in SAO sequential filter buffer size computation causes a heap buffer overflow when processing crafted H.265/HEVC images. Fixed in commit bdca875.

References
Summary

Signed integer overflow in pixel accessor functions causes heap out-of-bounds read/write when decoding crafted H.265/HEVC images. All decoder pixel access paths affected. Fixed in commit bdca875.

References
Summary

nilfs-utils through 2.3.0 does not validate the s_log_block_size field from NILFS2 filesystem superblocks. A crafted filesystem image with a large s_log_block_size value causes undefined behavior via excessive left-shift and subsequent out-of-memory conditions. Fix: PR #27 (commit 26efb5d).

References
Summary

The SOCKS5 reply parser in socat uses a signed char variable to store the address length byte from the SOCKS5 server response. When the server sends a value >= 128, the signed char becomes negative, bypassing the buffer size check. The negative value is then implicitly promoted to a large unsigned value in the subsequent recv() call, causing a heap buffer overflow. A malicious SOCKS5 proxy server can exploit this to crash the socat process or potentially achieve code execution. Fixed in socat 1.8.1.2.

References
Summary

The FIPS security header parsing in xrdp_sec_recv_fastpath() and xrdp_sec_recv() reads a pad value from the client-supplied TS_FP_FIPS_INFO structure and subtracts it from the stream end pointer without validating that pad is within the valid range (0-7 for DES3-CBC). A pad value larger than the remaining data causes a pointer underflow, producing a negative length cast to size_t in the HMAC signature verification, triggering a massive heap out-of-bounds read and crash. Pre-auth, requires crypt_level=fips. Co-discovered with Tencent Xuanwu Lab.

References
Summary

Evil-WinRM through version 3.9 has a path traversal vulnerability in the download_dir() function. A malicious SMB server or compromised Windows host can serve file paths containing directory traversal sequences (../) that write files outside the intended download directory on the attacker's machine. Fix: PR #81.

References
Summary

The xrdp_rdp_recv() function processes RDP PDUs in a loop, advancing the stream position by totalLength bytes per iteration. When totalLength is 0, the stream position never advances and xrdp enters an infinite loop, consuming 100% CPU on that connection's forked process. Pre-auth, no credentials needed.

References
Summary

The collectd input plugin enters an infinite loop when processing a crafted packet with specific type and length field combinations, causing complete denial of service. Fixed in PR #11849.

References
Summary

The forward input plugin reads past buffer boundaries when processing a crafted MessagePack message in message mode, causing a heap out-of-bounds read. Fixed in PR #11851.

References
Summary

The syslog input plugin has an integer overflow in priority/facility parsing that can lead to out-of-bounds memory access when processing crafted syslog messages. Fixed in PR #11852.

References
Summary

The zstd decompression handler has no upper bound on decompressed output size. A small compressed payload can decompress to gigabytes, exhausting server memory and causing denial of service. Fixed with a 100MB decompressed output cap in PR #11854.

References
Summary

The snappy decompression handler reads a 4-byte frame length from a buffer that may have fewer than 4 bytes remaining, causing an out-of-bounds heap read. Fixed with a 3-byte minimum read check in PR #11855.

References
Summary

The snappy decompression handler subtracts a fixed offset from a frame length field without underflow checking. A crafted frame_length smaller than the offset causes an integer underflow, leading to out-of-bounds memory access. Fixed in PR #11855.

References
Summary

The Elasticsearch bulk API handler reads past the buffer when processing a request containing an empty msgpack map, causing an out-of-bounds heap read. Fixed in PR #11856.

References
Summary

The collectd input plugin reads past the allocated buffer when processing a crafted packet with a type length exceeding the remaining data, causing a heap out-of-bounds read. Fixed in PR #11849.

References
Summary

The MQTT input plugin reads past the buffer when decoding the variable-length remaining length field in MQTT CONNECT packets, causing an out-of-bounds read. Fixed in PR #11853.

References
Summary

A missing break statement between the T_TLSA and T_SOA cases in dns_strrecord.c causes Postfix to fall through from TLSA DNS record handling into the SOA handler. The SOA handler reads additional fields from the response buffer without bounds checking, resulting in a heap out-of-bounds read or NULL dereference.

References
Summary

The psd (print sessions dump) CLI command in coturn takes a filename argument and directly passes it to fopen(cmd, "w") with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process. The file is truncated and overwritten with session dump data, whose content can be partially influenced by creating TURN allocations with crafted usernames. The CLI admin interface requires password authentication and binds to localhost by default.

References
Summary

In notify_user_response(), the check 'if (big_resp)' is inverted -- should be 'if (!big_resp)'. On successful aa_get_buffer() allocation, the function returns -ENOMEM and leaks the buffer. On failure, big_resp is NULL and execution continues with a NULL dereference. Additionally, the stack variable &uresp is always passed to the handler instead of big_resp, so the entire large-response code path is non-functional. An unprivileged local user can trigger the memory leak, leading to resource exhaustion. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

After kstrdup() allocates glob, the code checks 'if (!name)' instead of 'if (!glob)'. Since name is never NULL at that point, a kstrdup failure stores glob=NULL as clone->data.name, leading to a NULL pointer dereference on subsequent access. An unprivileged local user can trigger this to cause a kernel oops. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

In the TAILGLOB notification response path, kfree(name) is called on a pointer into the stack-allocated uresp union instead of the kstrdup'd glob pointer. This attempts to free a non-kmalloc'd address, corrupting slab metadata. Meanwhile the actual heap allocation (glob) is leaked. An unprivileged local user can trigger this to corrupt kernel memory. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The response_is_valid_name() function returns -EMSGSIZE or -EINVAL on validation failures instead of false. Since the return type is bool, (bool)(-EINVAL) = true, so every validation check passes. This allows notification responses with invalid sizes, out-of-bounds offsets, or incorrect flags to be accepted and processed as if well-formed. An unprivileged local user can send crafted responses to bypass all name validation. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

In knotif_update_from_uresp_perm(), the variable 'flags' is declared but not initialized in the else branch when uresp is NULL. The subsequent check 'if (!(flags & URESPONSE_NO_CACHE))' reads an uninitialized stack value, causing nondeterministic notification response caching behavior. An unprivileged local user can trigger incorrect caching of AppArmor notification responses. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The knotif_update_from_uresp_name() function modifies the profile->rules linked list via list_add_tail_entry() without holding any lock. This list is concurrently walked during file access mediation (aa_file_perm path). The source code contains a TODO comment acknowledging the missing lock. Concurrent modification and traversal causes list corruption, which can lead to use-after-free when a corrupted list entry is freed while another thread holds a stale pointer. An unprivileged local user can trigger the race condition to cause memory corruption and, theoretically, arbitrary code execution (local privilege escalation). Affects Ubuntu 24.04 (6.8) only. Rated HIGH by Canonical. Fixed in USN-8373-1 (6.8.0-124.124).

References
Summary

sizeof(unotif) evaluates to 8 bytes (pointer size on x86_64) instead of sizeof(*unotif) (the actual struct size). This allows kzalloc(size) to be called with a size between 8 and the struct size, and subsequent access to struct fields beyond the allocation causes a slab-out-of-bounds read. KASAN confirmed: 2-minute fuzzer reproduces reliably. Information disclosure from adjacent slab objects. An unprivileged local user can trigger this via the notification interface. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

The DFA unpack length calculation 'size - ((void *)unotif - pos)' expands to 'size + filter' instead of 'size - filter', giving the DFA parser access to up to 2*filter bytes past the buffer end. Invalid data from adjacent slab objects is fed into the AppArmor DFA policy engine, which can result in incorrect access control decisions. An unprivileged local user can exploit this to bypass AppArmor security policies. Rated HIGH by Canonical: 'can allow a local user to bypass security measures'. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

knotif_update_from_uresp_name() is called under listener->lock (spinlock) but performs sleeping operations: kzalloc(GFP_KERNEL), kstrdup(GFP_KERNEL), and aa_lookup_profile() (may acquire mutex). This triggers 'BUG: scheduling while atomic' on debug kernels and causes deadlocks on production kernels. An unprivileged local user can trigger kernel panic or deadlock. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

aa_new_ruleset() calls INIT_LIST_HEAD(&rules->list) without checking the kzalloc() return value. On memory allocation failure (especially likely under GFP_KERNEL-under-spinlock from CVE-2026-47334), this dereferences NULL and causes a kernel panic. Chains with CVE-2026-47334 (sleep under spinlock forces GFP_ATOMIC behavior, increasing OOM probability). An unprivileged local user can trigger this to cause a kernel panic. Affects Ubuntu 24.04 (6.8) only. Fixed in USN-8373-1.

References
Summary

In profile_opt_perm(), the variable declaration '__be16 l = htons(l)' reads l before initialization. The intention was htons(level) using the function parameter. Instead, l reads garbage from the stack and uses it for the DFA permission lookup, making all fine-grained sockopt mediation non-functional on Ubuntu 24.04. Policies restricting specific sockopt levels neither correctly allow nor correctly deny. An unprivileged local user can influence fine-grained network socket mediation. Affects Ubuntu 24.04 (6.8) only. Fixed in USN-8373-1.

References
Summary

In bind_map_addr(), addr4 is initialized to NULL. When sa_family is AF_UNSPEC and sk_family is PF_INET, the code reads addr4->sin_addr.s_addr while addr4 is still NULL (the assignment happens after the fallthrough to case AF_INET). This dereferences address 0x4, causing a kernel oops. Triggered when any AppArmor-confined application (snap, Docker, LXD) calls bind() with AF_UNSPEC on an IPv4 socket. Co-discovered with Trevor Lawrence. Affects Ubuntu 24.04 (6.8), 24.10 (6.17), 25.04 (7.0). Fixed in USN-8370-1 / USN-8373-1.

References
Summary

Multiple capability set processing functions in xrdp read from the network stream without validating that sufficient data remains. The S_CHECK_REM macro is a no-op in production builds (only active with --enable-devel-streamcheck). When a malicious RDP client sends capability sets with lengthCapability=4 (header only, zero data bytes), handlers read 2-8 bytes past the declared boundary. Pre-auth, within the 16KB MCS userData buffer.

References
Summary

The coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without any sanitization. The is_secure_string() filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations. Three injection vectors exist in turn_admin_server.c, each flowing through dbd_pgsql.c snprintf patterns into PQexec() which supports stacked queries. An authenticated admin can inject arbitrary SQL, gaining full database control and potentially OS-level access via PostgreSQL's COPY TO PROGRAM. The --web-admin flag must be enabled (disabled by default).

References
Summary

The radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack via memcpy with rinfo->nd_opt_ri_len as the size control, overflowing by up to 2016 bytes. Pre-authentication, network-adjacent attack vector (Layer 2). The nd_opt_ri_len field is an 8-bit value from the wire packet, and when greater than 1, the copy size is (nd_opt_ri_len - 1) * 8 bytes with no upper bound check.

References
Summary

The Terrascan server mode scan endpoints accept a webhook_url parameter (form field on file/scan, JSON field on remote/dir/scan, query param on k8s webhook validate). The user-controlled URL flows to executor.go -> webhook.Webhook{URL} -> SendPOSTRequest() which makes an HTTP POST with scan results to the attacker-specified URL. The HTTP client retries 10 times and follows redirects. No URL validation is performed anywhere in the code path. Product archived August 2023.

References
Summary

The remote/dir/scan endpoint accepts a remote_url JSON field passed to hashicorp/go-getter v1.7.5 DownloadWithType() with http remote type. go-getter HttpGetter fetches the URL and supports X-Terraform-Get redirect headers that can chain to file:// URLs via the registered FileGetter. The Netrc option is enabled, which can leak credentials. No URL validation or scheme restrictions are applied. Product archived August 2023.

References
Summary

ARM template templateLink.uri and parametersLink.uri fields, as well as CloudFormation AWS::CloudFormation::Stack TemplateURL fields, are fetched via go-getter with all detectors enabled including FileDetector, allowing direct file:// URL access. Both are triggered by uploading crafted IaC files to the unauthenticated file scan endpoint. Product archived August 2023.

References
Summary

mspac_internalize() in pac.c passes a int32_t ibuf value to krb5_pac_parse() which expects a size_t len parameter. A negative ibuf (e.g. -1) converts to SIZE_MAX on 64-bit systems. k5_input_init trusts the inflated length, and the PAC parser reads past the heap buffer. Also corrupts serialization state: bp moves backward and remain wraps. Reachable via gss_import_sec_context(). Fix merged on master (generalized k5_ser_unpack_len helper with bounds checks).

References
Summary

get_pac_princ_with_realm() in kdc_util.c returns 0 instead of ret in its cleanup label. When a PAC client name has 0 or 3+ '@' characters, ret is set to KRB5_PARSE_MALFORMED but the function returns success. The caller in do_tgs_req.c proceeds with a NULL principal pointer, causing a SIGSEGV crash. Reachable via cross-realm S4U2Proxy constrained delegation with a valid TGT.

References
Summary

krb5_rd_cred() in rd_cred.c counts tickets from krbcred->tickets but indexes encpart->ticket_info[] without checking that both arrays have the same length. If tickets exceeds ticket_info entries, the loop reads past the null-terminated ticket_info array, causing a NULL pointer dereference (crash) or heap data leak. RFC 6448 unencrypted KRB-CRED mode enables unauthenticated triggering.

References
Summary

Box_stts::get_sample_duration() and Box_ctts::get_sample_offset() in seq_boxes.cc contain while loops that never increment the index variable. A crafted HEIF/AVIF sequence file with a stts entry where sample_count is 0 triggers an infinite loop in init_sample_timing_table(), causing 100% CPU denial of service on any application using libheif for sequence decoding. The consistency check passes because 0 + N = N. Fixed on master (723b58d6) but not in v1.21.2 (latest release at time of discovery).

References
Summary

get_sample_info() in track.cc computes offset as base + sample_idx * size where the multiplication is performed in uint32_t. With size=255 and sample_idx above 16,843,009 (within the 18M security limit), the multiplication wraps around, causing auxiliary data to be read from an incorrect file position. This results in wrong content IDs or metadata for decoded sequence frames. Fix applied to master (commit 0484709).

References
Summary

Seven Hydra protocol modules (SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, HTTP-Proxy-Urlenum) build an NTLM Type-3 response from a server-supplied Type-2 challenge, base64-encode it into a 4096-byte intermediate buffer, then copy it into a 500-byte stack buffer via sprintf without a length check. A malicious server sending a crafted NTLM Type-2 challenge with a long domain string (up to 127 Unicode characters after truncation in ntlm.c) causes the base64-encoded response to exceed 500 bytes, overflowing the stack buffer by 18 to 330 bytes with partially attacker-controlled data. On default builds with FORTIFY_SOURCE, the process is terminated; on builds without stack protector, this enables code execution on the pentester's machine. Fix: commit 9cc84c20e7 (2026-05-19).

References
Summary

Use-after-free in JavaScriptCore's DFG/FTL JIT compiler. The GetIndexedPropertyStorage constant folding phase bakes a raw storage pointer (view->vector()) as a ConstantStoragePointer for TypedArray views on WebAssembly resizable buffers. The associated watchpoint only fires on buffer detach, not on resizable buffer grow. When memory.grow() reallocates the backing store in BoundsChecking mode, JIT-compiled code continues reading and writing through the stale pointer to freed memory. Exploitation yields a heap read/write primitive from web content without flags or user interaction beyond navigation. No cage in JSC means the primitive leads directly to renderer code execution. Patched in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5, visionOS 26.5 (May 11, 2026). WebKit Bugzilla 310207.

References
Summary

task_set_tokens() writes 40-byte task_token_ro_data via non-atomic memcpy into a read-only zone. Concurrent lock-free readers (ipc_kmsg.c, task_is_privileged) observe torn/inconsistent identity data. CVE-2025-24118 fix addressed p_ucred but missed task_tokens. Affects all architectures (x86_64, ARM64 SPTM, ARM64 PPL). An app may be able to cause unexpected system termination. Co-discovered.

References
Summary

Heap out-of-bounds read (4 bytes) in VLAN decapsulation memmove in lldpd.c. When a received frame size equals the MTU allocation, the memmove length argument is 4 bytes too large, reading past the heap buffer. Pre-authentication, Layer 2 adjacent attack vector. Fix merged.

References
Summary

When an OAuth2 provider has zero configured redirect URIs, the first authorization request permanently saves the attacker-supplied redirect_uri via provider.save(), running before authentication. An unauthenticated attacker poisons the provider so all subsequent OAuth2 flows redirect auth codes to the attacker. Patched in 2026.2.3 and 2025.12.5.

References
Summary

ApiCallRobotRouter.GetFileBlob only checks the enabled configuration flag but does not call _CheckFlowRobotId() unlike all other data-retrieval methods (GetFlow, ListFlowResults, ListFlowLogs, GetFlowFilesArchive, GetCollectedTimeline). A robot user can read any client's VFS files without prior relationship with the client. Fixed in PR #1162.

References
Summary

The ListScheduledFlows API endpoint has no approval check in the router and the handler uses args.creator (URL parameter) instead of context.username. Any authenticated user can list other users' scheduled flows on any client, leaking flow names, flow arguments containing investigation targets, and client IDs.

References
Summary

The sip_to_json() function in the sipmsgops module copies SIP header names into a fixed 255-byte stack buffer via memcpy without bounds checking. A single unauthenticated SIP packet with a header name exceeding 255 bytes overwrites the saved return address on the stack. On builds without stack canaries (the default when compiling from source), an attacker achieves RIP control and can execute a full ROP chain for a reverse root shell from a single UDP packet.

References
Summary

The construct_uri() function in msg_translator.c concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global buffer without bounds checking. When the combined URI component length exceeds 1024 bytes, the function overflows the static BSS buffer, corrupting adjacent global data. Pre-auth, triggered by SIP message processing.

References
Summary

The {s.b64encode} string transformation validates that the input fits in the 65536-byte transformation buffer, but base64 encoding expands output by 4/3x. An input of 49,153 to 65,535 bytes produces base64 output of 65,540 to 87,380 bytes, overflowing the static buffer by up to 21,844 bytes. Pre-auth, triggered during SIP message processing.

References
Summary

The TCP message framing layer parses Content-Length using unsigned int arithmetic with no overflow check. A Content-Length value that overflows uint32 (e.g. 4294967296) wraps to 0, causing the TCP framing layer to split the stream at the wrong boundary. The body of the first SIP message is then processed as a separate SIP message, enabling SIP message smuggling.

References
Summary

The find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes starting from a position at or past the logical end of the body buffer, reading up to 70 bytes past the boundary.

References
Summary

sl_unpack() discards the buffer length parameter (ibuflen), leaving all sl_unpack_* functions to use attacker-controlled count and offset values without bounds checking. The toc_entries field is computed but never validated (dead code), and toc_index values are unbounded. An authenticated AFP user with Spotlight access can trigger reads up to 64KB past the server_quantum allocation. Co-discovered.

References
Summary

afp_setfilparams reads file contents as a symlink target when FinderInfo matches the 'slnkrhap' magic without validating the target path. No absolute path check, no directory traversal check, and no volume boundary check are performed. An authenticated user can create symlinks pointing anywhere on the filesystem, enabling cross-protocol exploitation via Samba, NFS, or backup daemons that follow symlinks. Co-discovered.

References
Summary

The Express Entry Detail block's action_view_express_entity() method allows any unauthenticated visitor to access arbitrary Express entries by enumerating auto-increment integer IDs in the URL. The method fetches entries directly by ID without performing any permission check, bypassing the canViewExpressEntry() authorization enforced everywhere else. Express entries commonly contain form submissions (contact forms, support requests, surveys), making this a direct path to PII disclosure. Fixed in 9.5.1.

References
Summary

The message_detail conversation frontend endpoint allows unauthenticated users to read any conversation message by providing sequential integer message IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1. Independent co-discovery.

References
Summary

The message_page conversation frontend endpoint allows unauthenticated users to enumerate conversation messages by providing sequential integer conversation IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1.

References
Summary

The get_rating conversation frontend endpoint allows unauthenticated users to retrieve conversation message ratings by providing sequential integer message IDs. The endpoint does not verify that the requesting user has permission to view the conversation or its messages. Fixed in 9.5.1.

References
Summary

The AddMessage and UpdateMessage conversation controllers accept user-supplied file attachment IDs and load files directly via EntityManager::find() without checking per-file permissions (canViewFile). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, bypassing the file permission system. Fixed in 9.5.1.

References
Summary

The conversation DeleteFile controller has an inverted CSRF token validation condition. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing, effectively disabling CSRF protection for the file deletion endpoint. Fixed in 9.5.1.

References
Summary

The default Authorizer function in GoFiber's BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. With bcrypt-hashed passwords, the timing difference between a valid and invalid username is approximately 1,000,000:1 (~100ms vs ~100ns), enabling reliable remote username enumeration.

References
Summary

The BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header use the attacker's spoofed IP for logging, rate limiting, and access control.

References
Summary

The MySQL CNID backend constructs SQL queries via asprintf() string interpolation of AFP filenames without escaping. Three functions (cnid_mysql_add, cnid_mysql_get, cnid_mysql_find) pass user-controlled filenames directly into SQL strings, enabling full SQL injection for any authenticated AFP user. The entire module contains only one mysql_real_escape_string() call, and it is for a binary stamp blob, not for filenames. Co-discovered.

References
Summary

dsi_writeinit() computes the data payload size as ntohl(dsi_len) - dsi_doff using unsigned 32-bit arithmetic with no validation that dsi_len >= dsi_doff. When dsi_doff exceeds dsi_len, the subtraction wraps to near UINT32_MAX (~4GB), causing dsi_writeflush() to enter an infinite socket read loop (pre-auth DoS via desync chain) or ad_recvfile to splice ~4GB to disk (post-auth disk fill). Co-discovered.

References
Summary

Tinyproxy through 1.11.2 is vulnerable to HTTP request smuggling via Content-Length / Transfer-Encoding desynchronization. When both headers are present in a request, Tinyproxy processes one while forwarding both to the backend, allowing an attacker to smuggle requests. Fix: PR #610 (commit ff45d3b).

References
Summary

Tinyproxy through 1.11.2 accepts HTTP requests with duplicate Content-Length headers containing different values. It uses one value for its own processing while forwarding both to the backend server, enabling HTTP request smuggling. Fix: PR #610 (commit 6ed6fc9).

References
Summary

The CSP form-action directive is only enforced at form submission time (HTMLFormSubmission.cpp) and not re-evaluated on server-side redirects. A form submitted to a CSP-allowed origin that returns a 302/307 redirect to a disallowed origin succeeds without triggering a CSP violation event, enabling cross-origin POST data exfiltration. Co-discovered (Bug 1417822, reported 2017, unfixed, P3). A Web Platform Test (WPT) documents Firefox as expected FAIL for this behavior. Affects all Firefox versions.

References
Summary

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to view attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files. The function file_can_view_bugnote_attachments() does not pass the bugnote ID to file_can_view_or_download(), skipping the private bugnote visibility check entirely. The download path is correctly protected, but the view/content path is not.

References
Summary

The mc_issue_update() function in MantisBT allows users with UPDATER (level 40) access to edit, change view state, and modify time tracking on bugnotes belonging to other users, bypassing the DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. The issue update endpoint checks only update_bug_threshold before processing note modifications, with no per-note authorization check. This affects both the SOAP and REST API endpoints.

References
Summary

MantisBT's textarea custom field input function echoes user-supplied values without HTML encoding, allowing a textarea breakout and arbitrary HTML injection. The function cfdef_input_textarea() outputs the raw custom field value into a textarea element without htmlspecialchars(). Every other textarea in MantisBT uses string_textarea() for encoding, making this the sole omission. Default CSP blocks JavaScript execution, but CSS injection and HTML phishing remain exploitable.

References
Summary

The AJP message header validation in ajp_msg_check_header() uses an incorrect boundary check (> instead of >=), allowing a malicious or compromised AJP backend to send a response whose body length equals max_size. Since the 4-byte AJP header is already stored at the start of the buffer, the body write overflows the heap-allocated buffer by exactly 4 bytes with attacker-controlled content. The AJP secret directive does not protect against this because it only authenticates requests from Apache to the backend, not responses. Co-discovered.

References
Summary

The NTLM proxy authentication handler contains a stack-based off-by-one buffer overflow when processing proxy challenge responses. A malicious proxy server can trigger a 1-byte out-of-bounds write on the stack. NTLM authentication has been removed from the post-2.7 codebase.

References
Summary

Kanboard's web notification system renders event titles in HTML without escaping. The e() translation function calls translateNoEscaping() with no HTML escaping, and UrlHelper::link() concatenates the label into HTML output without escaping. A project member can inject arbitrary HTML into the notification page of any other project member via crafted task or comment titles. The default CSP blocks inline JavaScript, but meta http-equiv refresh auto-redirect and form action injection remain exploitable for phishing.

References
Summary

The TaskDuplicationController::chooseDestination() method accepts a user-controlled dst_project_id parameter and uses it to query destination project metadata (columns, swimlanes, categories, assignable users) without validating it against the authenticated user's project memberships. The authorization middleware only checks access based on the source task_id, not the dst_project_id. Any project member can enumerate the complete user list (IDs, usernames, full names), workflow columns, swimlanes, and categories of every project in the instance, breaking project isolation entirely in multi-tenant deployments.

References
Summary

The JSON-RPC API methods setSubtaskStartTime and setSubtaskEndTime accept a user-controlled user_id parameter that is not validated against the authenticated user's identity. The authorization layer only verifies project membership via the subtask, not ownership of the user_id. A project member can start and stop time tracking timers attributed to any other user on subtasks within the same project, falsifying work hour records that feed into project analytics and billing.

References
Summary

ERB's deserialization guard (@_init check) only protects ERB#result and ERB#run, but three other methods (def_method, def_module, def_class) evaluate @src via module_eval without the guard. An attacker crafts a malicious ERB object with @src beginning with 'end' to break out of the wrapping method definition, then calls def_module() (zero-argument, ideal gadget) to achieve immediate code execution during module evaluation. Combined with ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy, this creates a complete RCE chain triggered by Marshal.load on untrusted data, affecting Rails applications and any Ruby tool deserializing untrusted objects.

References
Summary

The EIGRP packet handlers for Query, Update, SIA-Query, and SIA-Reply messages contain a TLV skip routine for unknown/unhandled TLV types that performs an unchecked subtraction on a wire-controlled 16-bit length field. When the TLV length field is less than 4, the subtraction length -= 4 wraps around to a large value (near 65535), causing a loop that calls stream_getc() thousands of times past the stream boundary, triggering assert(0) and crashing the eigrpd process. Pre-auth, reachable via IP protocol 88.

Summary

The eigrp_read_ipv4_tlv() function uses asserting stream functions (stream_getw, stream_getc, stream_getl) to parse IPv4 Internal TLV data from wire packets. The callers only check that at least 1 byte remains before entering TLV parsing, but eigrp_read_ipv4_tlv reads a minimum of 26 bytes. An attacker can send a truncated EIGRP packet with a valid TLV type (0x0102) but insufficient data, causing eigrpd to crash via assert(0). Pre-auth, reachable via IP protocol 88.

Summary

The eigrp_hello_receive() function parses Hello TLVs using raw pointer arithmetic on the packet buffer. When a TLV has a length field of 0, the pointer advancement and remaining size accounting both become no-ops, creating an infinite loop that consumes 100% CPU and locks up the entire eigrpd event loop. A single packet permanently DoS-es the EIGRP daemon. Pre-auth, reachable via IP protocol 88.

References
Summary

The EIGRP header verification function eigrp_verify_header() has its authentication check commented out with //. Even when EIGRP MD5 or SHA256 authentication is configured, all incoming packets are accepted without validation. Additionally, eigrp_hello_authentication_decode() compares auth_type and length fields without ntohs(), so Hello authentication never works on little-endian systems. An unauthenticated attacker on the same network segment can inject arbitrary EIGRP routing updates, enabling route table manipulation and traffic interception.

References
Summary

The BGP Graceful Restart with Notification (GR-N) Hard Reset decapsulation function subtracts 2 from notify->length without checking that length >= 2. When a BGP NOTIFICATION with Hard Reset encapsulation contains only 1 byte of data, the subtraction underflows uint16_t to 65535, causing a 65535-byte heap out-of-bounds read via memcpy. Requires an authenticated BGP peer session with GR-N capability negotiated.

Summary

The ASLA (Application-Specific Link Attributes) sub-sub-TLV parser in IS-IS does not validate the wire-controlled subsubtlv_len field against remaining bytes before processing. A crafted IS-IS PDU where the ASLA sub-sub-TLV length exceeds the remaining data causes out-of-bounds reads beyond the subtlv boundary, uint8_t underflow in the readable counter (wrapping to 252-255), and parser desynchronization that corrupts all subsequent subtlv parsing. Crashes isisd via assert(0). Pre-auth at Layer 2.

References
Summary

The minimum size constants for SRv6 End.X SID (ISIS_SUBTLV_SRV6_ENDX_SID_SIZE=21, should be 22) and SRv6 LAN End.X SID (ISIS_SUBTLV_SRV6_LAN_ENDX_SID_SIZE=27, should be 28) are each 1 byte too small, not accounting for the mandatory subsubtlv_len byte. A subtlv with the minimum declared length passes validation but causes the parser to read 1 byte past the subtlv boundary. The read byte is used as subsubtlv_len, and unpack_tlvs() reads that many more bytes from adjacent data. Pre-auth at Layer 2.

References
Summary

The Flex-Algorithm Definition (FAD) sub-TLV parser in the Router Capability TLV (type 242) has two bugs: (A) unconditionally reads 4 fixed bytes before checking the length field, so length < 4 reads past the subtlv boundary and causes subsubtlvs_len = length - 4 to underflow uint8_t to 252-255; (B) missing bounds check on sub-sub-TLV length allows subsubtlvs_len -= 2 + subsubtlv_len to underflow. Both bugs cause the parser to read into adjacent TLV data, with admin_group_bulk_set() triggering heap realloc with attacker-controlled count. Pre-auth at Layer 2.

References
Summary

The lib_palette_update() function in xrdp's VNC backend processes RFB SetColourMapEntries messages without validating the first_color field against the palette[256] array bounds. A malicious VNC server can send first_color values up to 65535, causing attacker-controlled 24-bit values to be written at offsets up to 262,140 bytes past the palette array in the heap-allocated vnc struct. This overwrites adjacent struct fields including the trans pointer (which contains function pointers), providing a direct path to remote code execution. Co-discovered with Tencent Xuanwu Lab.

References
Summary

The lib_framebuffer_update() function computes pixel buffer size as cx * cy * bytes_per_pixel using signed 32-bit integer arithmetic. Since cx and cy are 16-bit values from the VNC server, the multiplication can overflow, producing a small positive value that causes an undersized heap allocation. The buffer is then passed to server_paint_rect with the original dimensions, causing xrdp_painter_copy to read up to 786 KB of heap memory past the allocated buffer. The leaked data is encoded and sent back to the attacker's RDP client, enabling ASLR bypass and credential theft. Co-discovered with Tencent Xuanwu Lab.

References
Summary

The WebCodecs ImageDecoder implementation creates MozPromise callback chains for metadata decode, frame count, and frame decode operations without calling Track() to store request handles. Unlike the sibling DecoderTemplate used by VideoDecoder, AudioDecoder, VideoEncoder, and AudioEncoder, ImageDecoder lacks request tracking entirely. After the Cycle Collector UNLINKs the decoder, mCompletePromise is set to nullptr, but Destroy() does not set mClosed or mComplete to true. The orphaned callback fires, enters OnMetadataFailed which sees mClosed == false, calls Close() which sees mComplete == false, and dereferences the null mCompletePromise pointer. The developer confirmed additional lifetime problems in Reset() and ProcessControlMessageQueue(). Affects Firefox 149 and 150. Fixed in Firefox 151, with uplift tracking for Firefox 150 and ESR 140.

References
Summary

The OPNsense authentication system passes login usernames directly into LDAP search filters via string interpolation without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters through the login form, Captive Portal (CORS: *), or OpenVPN authentication to enumerate directory users and probe attributes. Additionally, the LDAP authenticator overrides Base::authenticate() to bypass the 2-second constant-time timing normalization, creating a reliable timing side-channel for user enumeration. Co-discovered independently with Matt Andreko (CVE-2026-34578).

References
Summary

The SSH_MSG_EXT_INFO handler in libssh2 through 1.11.1 does not validate return values from _libssh2_get_string() when parsing extension info messages. A malicious SSH server can send a crafted EXT_INFO message that causes CPU exhaustion or denial of service during the pre-authentication phase. Fix: PR #1864.

References
Summary

libssh2 through 1.11.1 has an integer overflow in the chacha20-poly1305 transport handler (transport.c) when processing packet_length on 32-bit platforms. An unchecked packet_length value leads to a heap buffer overflow during decryption. A malicious SSH server or MITM attacker can trigger this to achieve remote code execution.

References
Summary

The Turbinia API server's POST /api/request/ endpoint accepts a recipe_data parameter containing Base64-encoded YAML. This YAML is deserialized using yaml.load() with the unsafe yaml.Loader class, which supports arbitrary Python object instantiation via !!python/object/apply and !!python/object/new directives. An unauthenticated attacker can achieve Remote Code Execution on the API server by sending a single HTTP POST request. The API has no server-side authentication enforcement by default. Code execution occurs during yaml.load() before any validation. Fixed in PR #1617 by replacing yaml.Loader with yaml.SafeLoader.

References
Summary

The POST /api/request/ endpoint accepts a recipe_name parameter that is used as a file path. The code checks os.path.exists(recipe_name) and if True, uses it directly as the file path to load and deserialize with the unsafe yaml.Loader. Combined with the ticket_id path traversal (TLSA-2026-0050), this creates a two-step unauthenticated RCE chain: upload a malicious YAML file to an arbitrary path via ticket_id traversal, then trigger its loading via recipe_name with an absolute path. The file is deserialized with yaml.Loader which supports arbitrary Python object instantiation. Fixed in PR #1617 by adding recipe_name sanitization and switching to yaml.SafeLoader.

References
Summary

The POST /api/evidence/upload endpoint accepts a ticket_id form parameter that is used directly in os.makedirs() and os.path.join() to construct the file storage path, without any path traversal validation. While the file_name parameter is validated by the safe_file_name() function, the ticket_id parameter is completely unvalidated. An unauthenticated attacker can write arbitrary files to arbitrary filesystem locations using directory traversal sequences in the ticket_id parameter. This also serves as the first step in the RCE chain described in TLSA-2026-0049. Fixed in PR #1617 by adding ticket_id validation.

References
Summary

Two unauthenticated API endpoints expose the full Turbinia server configuration including sensitive secrets. GET /api/config/ returns the complete configuration as JSON via toDict(), which includes EMAIL_PASSWORD, GCP_GENERATIVE_LANGUAGE_API_KEY, Redis connection details, Celery broker credentials, and database credentials. GET /api/config/download returns the raw configuration file from disk. The API has no server-side authentication enforcement by default. An unauthenticated attacker can retrieve all credentials and use them for lateral movement to Redis, Celery, PostgreSQL, OpenSearch, and GCP resources. Fixed in PR #1617.

References
Summary

On 32-bit platforms, decoding a WebP image whose VP8X header declares a canvas size (width × height) that overflows int32 returns a corrupt Image whose subsequent access panics the program. RFC 9649 §2.7 caps canvas size at 2^32 − 1 pixels, but the decoder neither rejects oversized canvases nor avoids constructing a malformed image, exposing any 32-bit Go service that decodes untrusted WebP input to a remote denial of service.

References
Summary

construct_hierarchy_string() in frontend_handlers.py builds raw HTML by concatenating upstream/downstream vulnerability IDs without escaping, then renders the result via Jinja2's |safe filter, bypassing the project's otherwise consistent auto-escaping (markdown uses safe_mode='escape'; every other template variable relies on auto-escape). An attacker who lands a crafted vulnerability ID (e.g., <img src=x onerror=...>) into any upstream OSV source database (GitHub Advisory DB, RustSec, PyPI Advisory, etc.) achieves stored XSS on osv.dev, executing in the browser of every visitor viewing a related vulnerability page. The upstream field is a repeated string in the OSV schema with no format validation at the protobuf level, so a malicious value looks like a normal vulnerability ID to a human reviewer. The review barrier is social, not technical. Reported via Google OSS VRP. Fixed in PR google/osv.dev#5228 (merged 2026-04-13) by applying markupsafe.escape() before HTML interpolation.

References
Summary

An authenticated user can create a public mock server whose response headers and body are fully user-controlled. By setting Content-Type: text/html and a JavaScript payload in the response body, the attacker achieves stored XSS on the backend origin. Since mock URLs share the same origin as the API and authentication cookies are httpOnly/sameSite:lax, the XSS executes with the victim's session context, enabling account takeover, admin escalation, and full data exfiltration via authenticated GraphQL calls. Co-discovered.

References
Summary

The reports_form_save() function accepts the format_file parameter via get_nfilter_request_var() (zero filtering) and stores it directly in the database. When the report is generated, reports_load_format_file() concatenates this value into a file path without path traversal validation. An authenticated user with Reports permission (realm 21) can read arbitrary server files including include/config.php (database credentials) by supplying a traversal payload such as ../include/config.php.

References
Summary

The IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of any issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID with Issue.objects.filter(id__in=issue_ids) without filtering by workspace or project, breaking tenant isolation in multi-workspace deployments.

References
Summary

The SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to Django's F() expression without validation, unlike the regular AnalyticsEndpoint which validates against an allowlist. An authenticated workspace member can extract values from any related database field, including workspace__owner__password (bcrypt hashes), API tokens, and email addresses, by abusing Django's field reference resolution in annotated queries.

References
Summary

unserialize_object() in Metasploit Framework's database import code calls Marshal.load() on attacker-controlled base64 data from imported XML and ZIP files. 15 call sites across the XML and ZIP importers feed untrusted data into Marshal.load() without any class restriction or validation. Arbitrary command execution achieved on Ruby 3.3.8 / RubyGems 3.6.7 (Metasploit's current supported environment) via a novel gadget chain: Hash key .hash triggers ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy#method_missing, which chains into ERB#def_module (bypassing the @_init guard) to reach module_eval with attacker-controlled code. The chain uses only ActiveSupport and ERB, both loaded in every msfconsole session, and bypasses all upstream RubyGems Marshal mitigations. Attack model: malicious scan results or export files imported by a pentester via db_import. 100% reliable, single-file trigger, 232-byte payload. The underlying deserialization primitive is tracked as CVE-2026-41316 (Ruby ERB). Fixed in PR #21214.

References
Summary

The fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 (xattr: switch to CLASS(fd)).

References
Summary

Use-after-free in vc_do_resize() (drivers/tty/vt/vt.c) when resizing a virtual console. The old screen buffer (vc_screenbuf) is freed and replaced, but a concurrent reader accessing the console via /dev/vcsN can still reference the stale pointer, leading to an out-of-bounds heap read (CWE-416). An unprivileged local user can trigger the race to leak kernel memory. Affects Linux kernel through 5.5.2.

References
Summary

Use-after-free in vgacon_invert_region() (drivers/video/console/vgacon.c). When a VGA console is resized, vgacon_invert_region() may access the old screen buffer after vc_do_resize() has freed it. This is the VGA-console-specific manifestation of the vc_do_resize race (CVE-2020-8647), resulting in a stale pointer dereference and heap information leak (CWE-416). Affects Linux kernel through 5.5.2.

References
Summary

Use-after-free in the ALSA timer subsystem (sound/core/timer.c) due to incorrect code refactoring. The snd_timer_open() function reuses the timeri pointer after snd_timer_close_locked() has freed the timer instance structure, resulting in a dangling pointer that subsequent operations dereference for read and write (CWE-416). Exploitable by an unprivileged local user via the /dev/snd/timer device. Affects Linux kernel before 5.3.11.

References
Summary

Use-after-free in debugfs_remove() (fs/debugfs/inode.c) caused by a race between file removal and concurrent dentry lookup. When a debugfs file or directory is removed while another thread traverses the filesystem (e.g., via readdir or open), the dentry can be freed while still referenced, leading to a dangling pointer dereference (CWE-416). The bug is reachable by any process with access to the debugfs mount. Affects Linux kernel 4.19.x and later.

References
Summary

Use-after-free in __blk_add_trace() (kernel/trace/blktrace.c) caused by a race between blktrace teardown and ongoing I/O tracing. When blk_trace_remove() runs concurrently with block I/O completion, the bt (blk_trace) structure is freed while __blk_add_trace() still writes trace records into the per-CPU relay buffer, producing a heap use-after-free write (CWE-416). Triggerable by an unprivileged user who can issue block I/O while an admin tears down tracing. Affects Linux kernel 5.4.x.

References
Summary

Use-after-free in perf_trace_lock_acquire() triggered by a race between perf event teardown and tracepoint callbacks. When a perf event is closed while lock tracepoints are active, the event's data structures can be freed while a concurrent tracepoint invocation still references them, leading to a dangling pointer read (CWE-416). Requires perf_event_open() access. Affects Linux kernel 5.3.10.

References
Summary

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert(). A crafted packet can trigger an out-of-bounds read, potentially leaking process memory or crashing the application. Co-discovered.

References
Summary

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). A crafted Babel routing protocol packet can trigger an out-of-bounds heap read, potentially leaking process memory or causing a denial of service. Co-discovered.

References
Summary

The Google Doc Embedder plugin (90,000+ active installs) lacks CSRF protection on its profile settings forms (options-general.php?page=gde-settings). An attacker can forge requests that create, edit, or delete embed profiles, including changing the file base URL, viewer permissions, and profile metadata. This requires an authenticated admin to visit visits a malicious page. The CSRF can be chained with the plugin's stored XSS in the description field to plant persistent payloads.

References
Summary

The Google Doc Embedder plugin (90,000+ active installs) renders the profile description field without sanitization in tab-profiles.php (the value is passed through _e() rather than esc_html()). An authenticated user with access to the plugin's settings can store a payload that executes whenever any admin views the embed profiles list.

References

159 Advisories Published