CVE Vulnerability Catalog

GitPython spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for <transport>:: remote-helper URLs) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted options). The description indicates the rollout did not cover all code paths.

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.

The description of this report does not contain sufficient technical information about the vulnerability — it only includes a note about the reporting method and references to files that were not attached. The nature and scope of the issue cannot be determined from it.

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can...

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.

Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.

Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.

The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

The filepath package in Go does not recognize paths with a \??\ prefix as special. On Windows, a path starting with \??\ is equivalent to a path starting with \\?\ and can be used to access arbitrary system locations.

A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.

Repeated use of the Unpacker after an error occurs may cause the process to crash with a SEGV. If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

A vulnerability in the DNS protocol, related to the Closest Encloser Proof aspect in RFC 5155 (when RFC 9276 guidance is skipped), allows remote attackers to cause a denial of service (DoS) by triggering excessive CPU consumption for SHA-1 computations. The attack involves sending DNSSEC responses in a random subdomain attack, known as the NSEC3 issue.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

A vulnerability in the hoek library before version 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. An attacker can exploit this flaw to modify object prototypes, leading to unauthorized access or code execution.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.