CVE Vulnerability Catalog

A flaw in Netty's `netty-codec-http` component. A remote attacker can send a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling.

A flaw in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

Vulnerability in Open edX Platform allows a course author or staff user with import permission to bypass path validation in _is_bad_path, which compares paths using startswith instead of comparing path components. A crafted .tar.gz archive can escape into a sibling course staging directory, causing limited cross-tenant file corruption.

Vulnerability in Open edX Platform involves lack of sanitization of discussion-title values in add_additional_attributes_to_notifications, allowing an enrolled student to place CSS-capable markup in post titles. This markup is rendered as safe HTML in email digests, enabling email-open tracking and content spoofing or phishing.

Vulnerability in Suricata allows treating IPv4 and IPv6 flows as equal without comparing IP family when raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. This can cause incorrect flowbit state, detection bypass, or IP-only bypass.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.

In Suricata from 8.0.0 until 8.0.6, a locally supplied detection rule combining frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata.

In Suricata prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP parsing for the remainder of the TCP flow, allowing later commands to evade parser-dependent rules and logging; IPS mode instead drops the flow.

Suricata from 8.0.0 to 8.0.6 has a vulnerability in the SIP parser where request and response body lengths are stored in 16-bit fields. A body larger than 65,536 bytes can truncate the length, preventing full frame inspection and allowing evasion of frame-based detection.

Vulnerability in Suricata's SMB parser can retain force-completed transactions on flows with one-directional payload, leading to unbounded per-flow state and CPU/memory exhaustion. Sustained one-directional SMB traffic can be exploited.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

Vulnerability in microsandbox exposes network config secrets and environment variables via command-line arguments, readable by other local users through process listings. This can disclose API keys, tokens, and other secrets on shared hosts, CI runners, and developer systems.

Vulnerability in Suricata's SMTP MIME parser does not fully reset state when processing Content-Type: message/rfc822 encapsulation, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.

Suricata from 8.0.0 to 8.0.6 has a vulnerability in src/datasets-context-json.c where it assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing.