CWE-1395
Allowed-with-ReviewDependency on Vulnerable Third-Party Component
Abstraction: Class · Status: Incomplete
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
118 vulnerabilities reference this CWE, most recent first.
GHSA-C6M7-Q6PR-C64R
Vulnerability from github – Published: 2025-12-12 16:41 – Updated: 2025-12-12 16:41Impact
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4
Patches
Upgrade immediately to @vitejs/plugin-rsc@0.5.7 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.6"
},
"package": {
"ecosystem": "npm",
"name": "@vitejs/plugin-rsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-497",
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-12T16:41:58Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\n`@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository\u0027s advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4\n\n### Patches\n\nUpgrade immediately to `@vitejs/plugin-rsc@0.5.7` or later.",
"id": "GHSA-c6m7-q6pr-c64r",
"modified": "2025-12-12T16:41:58Z",
"published": "2025-12-12T16:41:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4"
},
{
"type": "WEB",
"url": "https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-c6m7-q6pr-c64r"
},
{
"type": "PACKAGE",
"url": "https://github.com/vitejs/vite-plugin-react"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components"
}
GHSA-CPQF-F22C-R95X
Vulnerability from github – Published: 2025-12-12 16:41 – Updated: 2025-12-12 16:41Impact
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9
Patches
Upgrade immediately to @vitejs/plugin-rsc@0.5.7 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.6"
},
"package": {
"ecosystem": "npm",
"name": "@vitejs/plugin-rsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-400",
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-12T16:41:08Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\n`@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository\u0027s advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9\n\n### Patches\n\nUpgrade immediately to `@vitejs/plugin-rsc@0.5.7` or later.",
"id": "GHSA-cpqf-f22c-r95x",
"modified": "2025-12-12T16:41:08Z",
"published": "2025-12-12T16:41:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-cpqf-f22c-r95x"
},
{
"type": "PACKAGE",
"url": "https://github.com/vitejs/vite-plugin-react"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vite Plugin React has a Denial of Service Vulnerability in React Server Components"
}
GHSA-F3R2-88MQ-9V4G
Vulnerability from github – Published: 2025-12-17 20:56 – Updated: 2025-12-17 20:56Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
Affected product and versions
Projects are affected if they meet the following preconditions:
- Applications using the Auth0 Symfony SDK with versions between 5.0.0 and 5.5.0
- Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.
Resolution
Upgrade Auth0/symfony to version 5.6.0 or greater.
Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.5.0"
},
"package": {
"ecosystem": "Packagist",
"name": "auth0/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-345",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-17T20:56:37Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Description\nIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.\n\n### Affected product and versions\nProjects are affected if they meet the following preconditions:\n\n- Applications using the Auth0 Symfony SDK with versions between 5.0.0 and 5.5.0\n- Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.\n\n### Resolution\nUpgrade Auth0/symfony to version 5.6.0 or greater.\n\n### Acknowledgement\nOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.",
"id": "GHSA-f3r2-88mq-9v4g",
"modified": "2025-12-17T20:56:37Z",
"published": "2025-12-17T20:56:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g"
},
{
"type": "WEB",
"url": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479"
},
{
"type": "PACKAGE",
"url": "https://github.com/auth0/symfony"
},
{
"type": "WEB",
"url": "https://github.com/auth0/symfony/releases/tag/5.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK"
}
GHSA-F7CQ-5V43-8PWP
Vulnerability from github – Published: 2024-05-23 15:19 – Updated: 2024-05-23 15:19Impact
There is a vulnerability in GO managing malformed DNS message, which impacts Traefik. This vulnerability could be exploited to cause a denial of service.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.3
- https://github.com/traefik/traefik/releases/tag/v3.0.1
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.7.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-23T15:19:41Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nThere is a vulnerability in [GO managing malformed DNS message](https://groups.google.com/g/golang-announce/c/wkkO4P9stm0), which impacts Traefik.\nThis vulnerability could be exploited to cause a denial of service.\n\n### References\n\n- [CVE-2024-24788](https://www.cve.org/CVERecord?id=CVE-2024-24788)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.3\n- https://github.com/traefik/traefik/releases/tag/v3.0.1\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
"id": "GHSA-f7cq-5v43-8pwp",
"modified": "2024-05-23T15:19:41Z",
"published": "2024-05-23T15:19:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-f7cq-5v43-8pwp"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-5fq7-4mxc-535h"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.3"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.1"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24788"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop"
}
GHSA-F88M-G3JW-G9CJ
Vulnerability from github – Published: 2026-07-21 22:07 – Updated: 2026-07-21 22:07Impact
A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.
Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.
Patches
Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.
Using a globally-installed libvips?
Please ensure you are using the latest libvips 8.18.3.
Workarounds
Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.
sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] });
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sharp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.35.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T22:07:17Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libvips 8.18.3.\n\n### Workarounds\nAdd the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadNsgif\", \"VipsForeignLoadTiff\", \"VipsForeignLoadVips\"] });\n```",
"id": "GHSA-f88m-g3jw-g9cj",
"modified": "2026-07-21T22:07:17Z",
"published": "2026-07-21T22:07:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x"
},
{
"type": "WEB",
"url": "https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76"
},
{
"type": "WEB",
"url": "https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm"
},
{
"type": "WEB",
"url": "https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7"
},
{
"type": "WEB",
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj"
},
{
"type": "PACKAGE",
"url": "https://github.com/lovell/sharp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591"
}
GHSA-G3QJ-J598-CXMQ
Vulnerability from github – Published: 2026-03-24 19:10 – Updated: 2026-03-24 19:10Summary
fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in extractStrings() — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.
The crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint — single request, unauthenticated, instant kill.
Fixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.
Affected versions
fido2-lib <= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old cbor package — not affected.
Only affects systems where cbor-extract native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.
PoC
const { decode } = require("cbor-x");
decode(Buffer.from("7a10000000", "hex")); // exit code 139 (SIGSEGV)
CBOR text string header claiming 268MB in a 5-byte buffer. extractStrings() in extract.cpp line 87 calls readString() without bounds check. Reads past buffer into unmapped memory.
In context: attacker intercepts WebAuthn registration response, replaces attestationObject with the 5-byte payload, POSTs to the registration verification endpoint. Server calls attestationResult() → cbor-x.decode() → cbor-extract → SIGSEGV.
Fix
Bump cbor-x to >= 1.6.3 (which pulls cbor-extract >= 2.2.1).
-"cbor-x": "~1.6.0"
+"cbor-x": "^1.6.3"
— Malik X (@Xvush)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.5.7"
},
"package": {
"ecosystem": "npm",
"name": "fido2-lib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126",
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-24T19:10:38Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nfido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract \u003c= 2.2.0 has a heap buffer over-read in `extractStrings()` \u2014 a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.\n\nThe crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint \u2014 single request, unauthenticated, instant kill.\n\nFixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.\n\n## Affected versions\n\nfido2-lib \u003c= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old `cbor` package \u2014 not affected.\n\nOnly affects systems where `cbor-extract` native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.\n\n## PoC\n\n```js\nconst { decode } = require(\"cbor-x\");\ndecode(Buffer.from(\"7a10000000\", \"hex\")); // exit code 139 (SIGSEGV)\n```\n\nCBOR text string header claiming 268MB in a 5-byte buffer. `extractStrings()` in extract.cpp line 87 calls `readString()` without bounds check. Reads past buffer into unmapped memory.\n\nIn context: attacker intercepts WebAuthn registration response, replaces `attestationObject` with the 5-byte payload, POSTs to the registration verification endpoint. Server calls `attestationResult()` \u2192 `cbor-x.decode()` \u2192 `cbor-extract` \u2192 SIGSEGV.\n\n## Fix\n\nBump cbor-x to \u003e= 1.6.3 (which pulls cbor-extract \u003e= 2.2.1).\n\n```diff\n-\"cbor-x\": \"~1.6.0\"\n+\"cbor-x\": \"^1.6.3\"\n```\n\n\u2014 Malik X (@Xvush)",
"id": "GHSA-g3qj-j598-cxmq",
"modified": "2026-03-24T19:10:38Z",
"published": "2026-03-24T19:10:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/webauthn-open-source/fido2-lib/security/advisories/GHSA-g3qj-j598-cxmq"
},
{
"type": "WEB",
"url": "https://github.com/kriszyp/cbor-extract/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/kriszyp/cbor-extract/issues/3"
},
{
"type": "WEB",
"url": "https://github.com/kriszyp/cbor-extract/commit/1f6e0d9704149bdb5531d25f5d08a0280a71e2ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/webauthn-open-source/fido2-lib"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing"
}
GHSA-G9PC-8G42-G6VQ
Vulnerability from github – Published: 2025-04-08 21:31 – Updated: 2026-05-13 16:22The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "spiral/roadrunner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-22871"
],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-24T20:57:40Z",
"nvd_published_at": "2025-04-08T20:15:20Z",
"severity": "CRITICAL"
},
"details": "The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.",
"id": "GHSA-g9pc-8g42-g6vq",
"modified": "2026-05-13T16:22:16Z",
"published": "2025-04-08T21:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22871"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/issues/2166"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-783943.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/roadrunner-server/roadrunner"
},
{
"type": "WEB",
"url": "https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0"
},
{
"type": "WEB",
"url": "https://go.dev/cl/652998"
},
{
"type": "WEB",
"url": "https://go.dev/issue/71988"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3563"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/04/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency"
}
GHSA-GGPF-24JW-3FCW
Vulnerability from github – Published: 2025-04-23 02:26 – Updated: 2025-04-23 02:26Description
https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify weights_only=True to calls to torch.load() did not solve the problem prior to PyTorch 2.6.0.
PyTorch has issued a new CVE about this problem: https://github.com/advisories/GHSA-53q9-r3pm-6pq6
This means that versions of vLLM using PyTorch before 2.6.0 are vulnerable to this problem.
Background Knowledge
When users install VLLM according to the official manual
But the version of PyTorch is specified in the requirements. txt file
So by default when the user install VLLM, it will install the PyTorch with version 2.5.1
In CVE-2025-24357, weights_only=True was used for patching, but we know this is not secure. Because we found that using Weights_only=True in pyTorch before 2.5.1 was unsafe
Here, we use this interface to prove that it is not safe.
Fix
update PyTorch version to 2.6.0
Credit
This vulnerability was found By Ji'an Zhou and Li'shuo Song
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vllm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:26:06Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Description\n\nhttps://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify `weights_only=True` to calls to `torch.load()` did not solve the problem prior to PyTorch 2.6.0.\n\nPyTorch has issued a new CVE about this problem: https://github.com/advisories/GHSA-53q9-r3pm-6pq6\n\nThis means that versions of vLLM using PyTorch before 2.6.0 are vulnerable to this problem.\n## Background Knowledge\nWhen users install VLLM according to the official manual\n\n\nBut the version of PyTorch is specified in the requirements. txt file\n\n\nSo by default when the user install VLLM, it will install the PyTorch with version 2.5.1\n\n\nIn CVE-2025-24357, weights_only=True was used for patching, but we know this is not secure.\nBecause we found that using Weights_only=True in pyTorch before 2.5.1 was unsafe\n\nHere, we use this interface to prove that it is not safe.\n\n\n\n## Fix\nupdate PyTorch version to 2.6.0\n\n## Credit\nThis vulnerability was found By Ji\u0027an Zhou and Li\u0027shuo Song",
"id": "GHSA-ggpf-24jw-3fcw",
"modified": "2025-04-23T02:26:06Z",
"published": "2025-04-23T02:26:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-ggpf-24jw-3fcw"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54"
},
{
"type": "PACKAGE",
"url": "https://github.com/vllm-project/vllm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch \u003c 2.6.0"
}
GHSA-GV8R-9RW9-9697
Vulnerability from github – Published: 2026-02-20 21:14 – Updated: 2026-03-11 20:35Summary
There is a potential vulnerability in Traefik managing HTTP/3 connections.
More details in the CVE-2025-68121.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.37
- https://github.com/traefik/traefik/releases/tag/v3.6.8
Workarounds
No workaround
For more information
If you have any questions or comments about this advisory, please open an issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.7.34"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.11.36"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.37"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.6.7"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-20T21:14:27Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nThere is a potential vulnerability in Traefik managing HTTP/3 connections.\n\nMore details in the [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121).\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.37\n- https://github.com/traefik/traefik/releases/tag/v3.6.8\n\n## Workarounds\n\nNo workaround\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
"id": "GHSA-gv8r-9rw9-9697",
"modified": "2026-03-11T20:35:09Z",
"published": "2026-02-20T21:14:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-gv8r-9rw9-9697"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Traefik affected by TLS ClientAuth Bypass on HTTP/3"
}
GHSA-H2RP-8VPX-Q9R4
Vulnerability from github – Published: 2025-03-13 16:26 – Updated: 2025-03-13 16:26Description
There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002.
ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt.
ISA-2025-002 affects the Cosmos SDK package, where x/group can halt when erroring in EndBlocker.
Impact
If unaddressed, this could result in a chain halt.
Patches
Validators, full nodes, and IBC relayers should upgrade to cheqd-node v3.1.8. This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cheqd/cheqd-node"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T16:26:11Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Description\n\nThere have been two upstream security advisories and associated patches published under [ISA-2025-001](https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v) and [ISA-2025-002](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg).\n\n**[ISA-2025-001](https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v)** affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt. \n\n**[ISA-2025-002](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg)** affects the Cosmos SDK package, where `x/group` can halt when erroring in `EndBlocker`.\n\n### Impact\nIf unaddressed, this could result in a chain halt.\n\n### Patches\nValidators, full nodes, and IBC relayers should upgrade to [cheqd-node v3.1.8](https://github.com/cheqd/cheqd-node/releases/tag/v3.1.8). This upgrade does not require a software upgrade proposal on-chain and is meant to be non state-breaking.",
"id": "GHSA-h2rp-8vpx-q9r4",
"modified": "2025-03-13T16:26:11Z",
"published": "2025-03-13T16:26:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cheqd/cheqd-node/security/advisories/GHSA-h2rp-8vpx-q9r4"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg"
},
{
"type": "WEB",
"url": "https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v"
},
{
"type": "WEB",
"url": "https://github.com/cheqd/cheqd-node/commit/5a58b08dfb8dfc24631fb85b641cb75e9178d07f"
},
{
"type": "PACKAGE",
"url": "https://github.com/cheqd/cheqd-node"
},
{
"type": "WEB",
"url": "https://github.com/cheqd/cheqd-node/releases/tag/v3.1.8"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)"
}
Mitigation
In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
Mitigation
Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Mitigation
Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Mitigation
Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
Mitigation
Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.
No CAPEC attack patterns related to this CWE.