CVE Vulnerability Catalog

In Twisted 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py passes characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing catastrophic backtracking. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output.

In yawkat LZ4 Java prior to 1.11.2, LZ4DecompressorWithLength trusts the four-byte decompressed-length header before validating input, allowing a five-byte input to request up to ~2 GiB and exhaust the JVM heap. Overloads writing to a caller-provided buffer are not affected.

In yawkat LZ4 Java prior to 1.11.2, LZ4BlockInputStream.refill() validates the compressedLen field as nonnegative but allocates a buffer of that attacker-controlled size before reading payload data. A header-only stream can request a near-2 GiB allocation and exhaust the JVM heap.

The yawkat LZ4 Java library versions 1.7.0 through 1.11.4 contain a vulnerability in the insecure creation of a temporary file. An attacker with access to a shared temporary directory can replace the native library file before it is loaded, potentially leading to code execution in the victim's context.

In yawkat LZ4 Java prior to 1.11.4, LZ4FrameInputStream.readHeader() allocates two 4 MiB block buffers for maximum-block-size frame headers, and the default concatenated-frame mode allows streams with many minimal empty frames to trigger ~8 MiB allocation per 11 input bytes without producing output.

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption.

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that allows an attacker to inject a '__proto__' key into a JavaScript object. This overwrites the object's prototype, potentially leading to security decisions based on attacker-controlled data.

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that does not enforce a maximum nesting depth. A sufficiently deep structure can cause a JavaScript stack overflow, leading to a crash of the process or service.

Handlebars from 4.0.0 to 4.7.10 accepts pre-parsed AST objects in compile() and precompile() while validating only selected values. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values, leading to code execution on the server. Applications that pass only template strings are not affected. Fixed in 4.7.10.

Handlebars versions from 3.0.0 to 4.7.10 are vulnerable because lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list. An attacker who can render a controlled template with allowProtoMethodsByDefault enabled can access the Function constructor via a bypass, allowing attacker-controlled JavaScript to execute with the server application's privileges.

In Handlebars from 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source in an inline script element, a closing script delimiter can end the element and cause following markup to be parsed and executed.

A heap-based buffer overflow was found in GIMP's DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size.

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin.

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough.

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request.

Improper Handling of Unicode Encoding in the SmtpPickupDirAppender of Apache log4net. Content the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, makes the write throw, discarding every buffered event in the batch and potentially leaving a truncated mail in the pickup directory. Only applications using SmtpPickupDirAppender are affected, in versions from 1.2.9 before 3.5.0.

Improper Neutralization of Null Byte or NUL Character in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ends the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, is silently lost. Only applications on Windows using OutputDebugStringAppender are affected, in versions from 1.2.9 before 3.5.0.

Improper Neutralization of Null Byte or NUL Character in the EventLogAppender of Apache log4net. A NUL character in logged content ends the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, is silently not stored. Only applications on Windows using EventLogAppender are affected, in versions from 1.2.9 before 3.5.0.

Improper neutralization of input during web page generation ('cross-site scripting') in Apache Commons BCEL. This occurs when using Class2HTML to generate webpages for possibly attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). Affects versions before 6.13.0.

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.