CVE Vulnerability Catalog

hickory-resolver before version 0.26.2 fails to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS.

A flaw in Netty netty-codec-smtp is the improper validation of Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands, leading to SMTP command smuggling.

A flaw in Netty's HTTP/1 to HTTP/2 conversion process occurs when an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header. Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority.

A flaw in Netty causes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests to be incorrectly processed as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information.

A flaw in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can supply a different Host header, producing a malformed HTTP/2 CONNECT request.

A flaw in Netty's RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in RTSP requests. A remote attacker can send a specially crafted RTSP request, leading to method-token smuggling.

A flaw in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This leads to memory exhaustion.

A flaw in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can use HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to unbounded growth of a per-connection queue and excessive memory consumption.

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function fails to update the file extension after MIME validation, allowing a .php extension to persist and execute via PHP-FPM.

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM. The sanitizer leaves crypto.setFips callable, allowing guest code to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING with content exactly [0x00], causing an underflow and panic. Reachable via BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Requires an application that opts in to CRL revocation checking and parses attacker-influenced CRL bytes; default rustls configuration is unaffected. Fixed in 0.103.13 and 0.104.0-alpha.7.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, not covering subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with UPDATE_SCHEMA privilege can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke ResourceBundle.getBundle(String) to read .properties resources from the application classpath, disclosing sensitive configuration data. Fixed in 26.9.1.

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query paths reaching data through LSM index files or the TimeSeries engine never invoke that check, so an authenticated user denied readRecord/deleteRecord can still read indexed key values, record IDs, MAX/MIN values, TimeSeries samples, learn record counts, and delete index entries, desynchronizing the index from data. Index and type names are discoverable via SELECT FROM schema:indexes. Affects embedded and server deployments and all transports. Fixed in 26.9.1.

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts.

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

A flaw in the Netty STOMP codec. A remote attacker can send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability can lead to an infinite decode loop.

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted via POST is received and fopen() opens the URL in binary read-only mode, then the content is written to /tmp/ with a filename derived from basename() of the URL. This operation requires no authentication.