CVE Vulnerability Catalog

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9] and [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash.

In Eclipse Vert.x (vertx-grpc-server module), the configurable maximum message size limit for gRPC is applied to the compressed size rather than the actual uncompressed content size. This allows an attacker to send a compressed message that expands to far more memory than the configured limit.

The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.

In the Eclipse Vert.x MySQL client (vertx-mysql-client), the column definition array is pre-allocated based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server (or a man-in-the-middle attacker) can send a crafted packet with an extremely large column count, causing a massive heap allocation.

In the Eclipse Vert.x MQTT client (vertx-mqtt), MqttClient stores every inbound QoS 2 PUBLISH message in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet. This map has no size limit, and the maxInflightQueue option only constrains the outbound path.

In the binary array decoder of the Eclipse Vert.x PostgreSQL client (vertx-pg-client, DataTypeCodec.binaryDecodeArray), a Java array is allocated based on a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server (or an on-path attacker on an unencrypted connection) can send a crafted DataRow message with an excessively large array dimension value.

In the TDS message decoder of the Eclipse Vert.x MSSQL client (vertx-mssql-client), inbound TDS packets are aggregated into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag.

In Eclipse Vert.x, the uniqueItems keyword validation (vertx-json-schema module) uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time.

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash.

Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

In Rancher, a user with the ability to create a project on a certain cluster can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, leading to privilege escalation, because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

In Steve, by default an insecure option was used that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.

In Eclipse Vert.x (vertx-http-proxy module), the body transformer interceptor relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. The vulnerability requires the use of an intercepting body transformer.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocated when decompressing frames or messages. This allows a zip bomb style denial-of-service attack.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or a man-in-the-middle attacker, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation.

In bhyve's framebuffer device model, maximum resolution constants were duplicated between the framebuffer and RFB modules and got out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

In bhyve's HDA audio device model, zero-length Buffer Descriptor List (BDL) entries were not checked when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields could also be modified by the guest after validation.