CVE Vulnerability Catalog

In GraphQL-Ruby before version 2.6.6, when using Execution::Next, authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver and its subclasses (including Mutation, RelayClassicMutation, and Subscription).

The filepath package in Go does not recognize paths with a \??\ prefix as special. On Windows, a path starting with \??\ is equivalent to a path starting with \\?\ and can be used to access arbitrary system locations.

The Go HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. The fix prevents sending requests with invalid Request.Host or Request.URL.Host values.

A vulnerability in the Go crypto/tls library allows a DoS attack by sending extremely large RSA keys in certificate chains, causing high CPU usage during signature verification. The fix restricts RSA key sizes transmitted during handshakes to a maximum of 8192 bits.

A vulnerability in the Go net/http library allows a malicious HTTP sender to use chunk extensions to force a receiver to read many more bytes from the network than are in the body. A malicious HTTP client can exploit this to cause a server to automatically read a large amount of data (up to about 1 GiB).

The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.

A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.

A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.

The Go HTTP client drops sensitive headers (e.g., Authorization) after a cross-domain redirect, but may re-send them on a subsequent same-domain redirect, posing a potential data leak risk.

The Diffie-Hellman Key Agreement Protocol allows long exponents, making certain calculations unnecessarily expensive. The 1996 van Oorschot and Wiener paper showed that appropriately short exponents can be used with adequate subgroup constraints, but these are not utilized.

A vulnerability in the os package of the Go standard library allows improper access to the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") opens the parent directory, bypassing access restrictions.

A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.

A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.

The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection leading to an open redirect. This is considered lower-severity as it cannot be exploited from browsers or email clients.

A race condition in the Go database/sql package can overwrite expected results when a query is cancelled during the Scan method call while other queries run in parallel.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.