CVE Vulnerability Catalog

In libarchive before version 3.6.2, the software does not check for an error after calling the calloc function, which can return a NULL pointer, leading to a NULL pointer dereference.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.

Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.

The GD Graphics Library (LibGD) through version 2.3.2 has an out-of-bounds read due to the lack of certain gdGetBuf and gdPutBuf return value checks.

A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.

In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.

Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.

A vulnerability in Go's HTTP/2 implementation allows a malicious client to rapidly create and reset requests, causing excessive server resource consumption. Although the number of concurrent streams is limited by MaxConcurrentStreams, resetting requests enables the attacker to continuously send new requests.

The filepath package in Go does not recognize paths with a \??\ prefix as special. On Windows, a path starting with \??\ is equivalent to a path starting with \\?\ and can be used to access arbitrary system locations.

The Go HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. The fix prevents sending requests with invalid Request.Host or Request.URL.Host values.

A vulnerability in the Go crypto/tls library allows a DoS attack by sending extremely large RSA keys in certificate chains, causing high CPU usage during signature verification. The fix restricts RSA key sizes transmitted during handshakes to a maximum of 8192 bits.

A vulnerability in the Go net/http library allows a malicious HTTP sender to use chunk extensions to force a receiver to read many more bytes from the network than are in the body. A malicious HTTP client can exploit this to cause a server to automatically read a large amount of data (up to about 1 GiB).

The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.

A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.

A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.

A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.

The Go HTTP client drops sensitive headers (e.g., Authorization) after a cross-domain redirect, but may re-send them on a subsequent same-domain redirect, posing a potential data leak risk.

REXML is an XML toolkit for Ruby. Versions 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you parse untrusted XMLs, you may be impacted. REXML gem 3.4.2 or later includes the patches.