CVE-2026-2597
HighSummary
Wersje Crypt::SysRandom::XS przed 0.010 dla Perla są podatne na przepełnienie bufora w stercie w funkcji XS random_bytes(). Funkcja ta nie weryfikuje, czy parametr długości jest nieujemny, co może prowadzić do korupcji pamięci i awarii aplikacji.
Risk Assessment
Podatność ta może prowadzić do awarii aplikacji (denial of service) w przypadku, gdy aplikacje przekazują niezweryfikowane dane do parametru długości. Choć w typowych zastosowaniach długość jest ustalana przez wywołującego, co zmniejsza ryzyko, to jednak aplikacje z niezaufanym wejściem są narażone.
Recommendation
Zaleca się aktualizację do wersji Crypt::SysRandom::XS 0.010 lub nowszej. Należy również wprowadzić walidację danych wejściowych przekazywanych do parametru długości, aby zapobiec potencjalnym atakom.
Related vulnerabilities
- CVE-2026-15688Critical
A vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting stems from an incorrect implementation of the authentication algorithm. A local attacker can successfully authenticate even with an invalid block password by modifying part of the executable module in memory.
- CVE-2026-87796Critical
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CVE-2026-61594Critical
djust prior to version 1.0.7 has a vulnerability in the WebSocket transport that bypasses standard Django authorization mechanisms (such as LoginRequiredMixin, PermissionRequiredMixin, etc.) and the staff gate in the admin extension. Mount authorization is done via check_view_auth, not the View.dispatch() chain, allowing anonymous or under-privileged clients to open a WebSocket and dispatch view handlers, including admin ones.
- CVE-2026-92805Critical
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.
- CVE-2026-92787Critical
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
- CVE-2026-76460CriticalActively exploited
A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This is due to insufficient authentication control on an API endpoint. An attacker could send a crafted request to gain unauthorized access to the device by bypassing the web-based management interface.
- CVE-2026-75513Critical
Marten from version 7.0.0 until 9.13.0 has a vulnerability involving interpolation of runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization in several LINQ and tenant-management paths. The primary confirmed vector is a dictionary indexer key used by Where filters. This could enable filter or multi-tenant authorization bypass and blind data exfiltration, and in some configurations data modification.
- CVE-2026-20332Critical
Vulnerabilities in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software are related to improper access control issues (CWE-284). They were discovered during an internal security review and have been addressed in a software hardening release.
- CVE-2026-20284Critical
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This is due to insufficient validation of user-supplied input in REST API calls. A successful exploit could allow the attacker to view or modify data on the underlying database, and in single-node deployments could cause a DoS condition.
- CVE-2026-92808Critical
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services reachable only from the server. One such internal service exposes configuration and credential material without authentication, relying on local origin, which is satisfied by forged requests.
Original NVD description (English source)
Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service). In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.