CVE Vulnerability Catalog

In pupnp, parse_hostport synchronously calls getaddrinfo while processing attacker-supplied hostnames from inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service.

In libIEC61850, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. This causes a stack buffer over-read and copies those bytes into the caller-owned listName buffer, potentially crashing the server on a defineNamedVariableList request.

In libIEC61850, parseUserInformation checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path swallows the error, reads buffer[-1], resets parsing, and repeats the same state, leading to an infinite CPU loop or an out-of-bounds read and process abort.

In pupnp, raw_to_int in httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before storing it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser may accept a body length different from the declared value. Fixed in 2.0.2.

In pupnp, Transfer-Encoding: chunked causes the HTTP parser to leave content_length at zero while decoded bytes accumulate in msg.entity. The g_maxContentLength checks in http_RecvMessage do not enforce the same limit on decoded chunked bodies, so a remote peer can make the process buffer an entity larger than the configured maximum. Fixed in 2.0.2.

In pupnp, ixmlNode_compare passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp, though non-namespaced attributes legitimately leave them NULL. When ixmlElement_removeAttributeNode compares two distinct attributes with the same nodeName, the comparison dereferences NULL and crashes the process. Fixed in 2.0.2.

In TuxGuitar, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive (including the .tg file itself) whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class. When the file is opened, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with TuxGuitar process privileges. Fixed in 2.1.0.

In libIEC61850, alternateArrayAccess does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can crash servers whose data models contain arrays. Fixed in 1.6.2.

In libIEC61850, the MMS file service accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer, disclosing prior response data and protocol fragments to an unauthenticated remote client. Fixed in 1.6.2.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

In countly-server, public image and screenshot routes using the local fs storage backend call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception. Fixed in 24.05.50 and 25.03.44.

In countly-server, the authenticated data-migration deletion route passes the user-controlled exportid to clean_up_data without path validation. The identifier is concatenated into a path resolved outside the intended import directory and removed recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees. Fixed in 24.05.50 and 25.03.44.

In countly-server, public image and screenshot routes concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream, allowing arbitrary readable server files to be disclosed. Fixed in 24.05.50 and 25.03.44.

In github.com/gomarkdown/markdown, parser.IsSafeURL slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and via direct calls to parser.IsSafeURL. Fixed in 0.0.0-20260724235538-61af6e1e6971.

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration. Opening a crafted repository may allow attackers to execute arbitrary code.

JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. The parser fails to detect lack of forward progress.

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu authorizes the request only by comparing the target role's level with the caller's minimum level, without validating the granted menu set or preventing self-role modification. A logged-in non-admin user with the delegated roles:edit permission can submit its own role id with an arbitrary list of menu ids.

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another, and the archive's unmerge does not reverse this.

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.