CVE Vulnerability Catalog

In Apache Airflow Keycloak provider from version 3.3, the user identity is taken from the signed Airflow session token, but the Keycloak access and refresh tokens used for authorization come from separate, unauthenticated cookies and are never checked for consistency with the identity. This allows pairing foreign tokens with one's own session.

An out-of-bounds read (buffer over-read) in HTTP Cache-Control response header parsing in the QtNetwork module in Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server. Only the client side is affected and 32-bit builds are not affected; the access is read-only, with no information disclosure and no code execution.

On specific platforms using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces. This may result in temporary multicast traffic loss during the affected period.

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

An unauthenticated P4Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. By crafting a malicious packet during session initiation, an attacker can obtain complete administrative control over the switch.

On affected platforms running Arista EOS with SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this information could use it for unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the NMS.

On affected platforms running Arista EOS with OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

In Apache ZooKeeper, in FIPS mode, peer hostname verification in quorum TLS is not enforced. Despite enabling the relevant options, the connection accepts a CA-trusted certificate even if the SAN does not match the connected host, allowing a malicious certificate to join quorum traffic.

In Apache ZooKeeper, there is an information disclosure via SetWatches reconnect replay due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs.

On affected platforms running Arista EOS, an authenticated user with access to gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.

In fastify before version 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, causing Node.js to throw while serializing response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route using trailers crashes the server process and drops all in-flight requests; it can be repeated on every restart. The issue is fixed in fastify 5.12.5.

In the Linux kernel, in the ksmbd module, there is a vulnerability to out-of-bounds reads in share config responses. Lack of validation of IPC data sizes before processing variable-length fields can lead to reading beyond the allowed memory area.

A use-after-free vulnerability exists in the Linux kernel perf subsystem when perf mmap() revival races with the last munmap(). perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() to reattach a buffer that is then freed while another process still has it mapped.

In the Linux kernel, the rt6_multipath_rebalance() function is vulnerable to a divide-by-zero. A concurrent update of ignore_routes_with_linkdown can make the first pass return zero while the second sees an eligible nexthop, causing a division by zero in rt6_upper_bound_set().

In the Linux kernel, the gtp_newlink() error path lacks synchronize_net(), leading to a use-after-free. After clearing sk_user_data without waiting for an RCU grace period, concurrent packet reception in gtp_encap_recv() may still use a pointer to freed memory.

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.