CVE Vulnerability Catalog

In the Linux kernel, ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, acomp_request_clone() copies only the stack-sized object, so the clone has no storage for the async provider request context. Providers such as QAT write past the allocation through acomp_request_ctx(), reported by KASAN as a slab OOB write.

In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.

In the Linux kernel, in netfilter nf_tables the hardware offload step is performed before building the chain blob. Allocating the chain blob before the ruleset offload reduces the chance of entering an inconsistent state where the offloaded ruleset in the NIC and the software ruleset differ.

In the Linux kernel, the stmmac network driver's RX path was converted to zero-copy, but NET_IP_ALIGN was not carried over into stmmac_rx_offset(). As a result, the IP header lands at a misaligned address, causing an alignment fault and kernel panic on architectures such as ARM32 when receiving e.g. an ICMP echo request.

In the Linux kernel's slip driver, there is a use-after-free vulnerability in slip_receive_buf() when racing against a TTY hangup. slip_hangup() only calls slip_close(), causing concurrent access to freed memory.

In the Linux kernel's TCP implementation, devmem TX without zero-copy is not enforced. When NETIF_F_SG is absent, the copy path may attempt invalid iovec access, causing errors or breaking invariants.

MidnightBSD Package Manager (mport) prior to 2.7.8 did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could cause downloaded package data to be written outside the intended cache location or to an unsafe destination name.

The mport_fetch_bootstrap_index() function in libmport/fetch.c prior to 2.7.8 could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror could therefore cause mport to proceed with an unverified or tampered bootstrap package index.

In mport prior to 2.7.8, mport_decompress_zstd() in libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused partial index output to remain available, resulting in package-index integrity loss or denial of service.

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

In pgAdmin 4's Backup tool, the client-supplied database name was passed to pg_dump as a bare trailing positional argument without validation. Because pg_dump parses options with getopt_long, which permutes arguments, a value beginning with a dash (e.g. --file=/path) was treated as an option, overriding the previously set --file and allowing files to be written outside the File Manager storage directory. The same field also allowed connection-string injection, redirecting pg_dump to an attacker-controlled server along with the database password from the PGPASSWORD environment variable.

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream without protobuf element limits, then processRpc and processRpcSubOpt synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An unauthenticated attacker can place a victim RSA peer ID in msg.from, sign the message with the attacker's private key, and supply the attacker's public key in msg.key, causing the message to be accepted and propagated as authored by the victim. Applications that trust message.from for validators, authorization, accounting, moderation, reputation, or audit logging can process attacker-controlled data under false origin attribution. The issue is fixed in version 16.0.5.

The AsyncHttpClient (AHC) library in versions from 2.0.0 until 2.16.1 and 3.0.12 installs the HTTP/1.1 response decompressor without a cumulative output-size limit. A hostile or compromised server can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError. Brotli and zstd are also affected, and in versions 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well.

The AsyncHttpClient (AHC) library in versions from 2.1.0 until 2.16.1 and 3.0.12 can expose authenticated SOCKS proxy credentials to the origin server. The Proxy-Authorization header is attached without confirming the request is sent to an HTTP proxy, so preemptive authentication leaks plaintext credentials, and with the default flow a hostile origin can force NTLM, Kerberos, or SPNEGO credentials through the SOCKS tunnel via a 407 response.

ExifReader before version 4.41.1, when parsing attacker-controlled HEIC or AVIF ISO-BMFF files, trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, so the parser can allocate up to itemCount multiplied by extentCount objects without an allocation budget, causing heap growth or memory exhaustion and terminating a Node.js process.

Steeltoe in versions from 4.0.0 until 4.3.0, in ConsulDiscoveryClient, constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing an exception that aborts construction of the entire instance list and makes the targeted service undiscoverable; when GetAllInstancesAsync enumerates all services, one malformed instance can abort enumeration across every service.