Common Weakness Enumeration
CWE-248
AllowedUncaught Exception
Abstraction: Base · Status: Draft
An exception is thrown from a function, but it is not caught.
529 vulnerabilities reference this CWE, most recent first.
GHSA-F269-VFMQ-VJVJ
Vulnerability from github – Published: 2026-03-13 20:07 – Updated: 2026-03-13 20:07
VLAI
Summary
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
Details
Impact
A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.
Patches
Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Workarounds
There are no workarounds.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.24.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-1528"
],
"database_specific": {
"cwe_ids": [
"CWE-1284",
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T20:07:26Z",
"nvd_published_at": "2026-03-12T21:16:25Z",
"severity": "HIGH"
},
"details": "### Impact\nA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici\u0027s ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. \n\n### Patches\n\n\n Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\n### Workarounds\n\nThere are no workarounds.",
"id": "GHSA-f269-vfmq-vjvj",
"modified": "2026-03-13T20:07:26Z",
"published": "2026-03-13T20:07:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1528"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3537648"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodejs/undici"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client"
}
GHSA-F2JV-WJJC-2C94
Vulnerability from github – Published: 2026-04-22 18:31 – Updated: 2026-04-29 23:02
VLAI
Summary
uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths
Details
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "coreutils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35348"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T23:02:15Z",
"nvd_published_at": "2026-04-22T17:16:37Z",
"severity": "MODERATE"
},
"details": "The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.",
"id": "GHSA-f2jv-wjjc-2c94",
"modified": "2026-04-29T23:02:15Z",
"published": "2026-04-22T18:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35348"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/issues/9696"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths"
}
GHSA-F5P7-9FR5-8JMJ
Vulnerability from github – Published: 2026-05-06 21:24 – Updated: 2026-05-13 16:41
VLAI
Summary
Granian vulnerable to DoS via WSGI response header panic
Details
Summary
Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error.
This issue requires a buggy or attacker-influenced WSGI application to emit invalid headers. It is not a parser bug in Granian's request path. The security impact is that application mistakes which should result in a 500 instead kill the worker process.
Details
https://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/wsgi/io.rs#L39-L42
If either conversion fails, .unwrap() panics. In release builds Granian uses panic = "abort", so the panic terminates the worker.
Preconditions
The attacker must be able to influence a header name or value produced by the WSGI application, or the application must otherwise generate invalid headers.
Examples include:
- a header name containing a space
- a header value containing
\r\n - a header value containing a null byte
These are realistic failure modes for applications that reflect user-controlled data into headers such as Location, Content Disposition, or custom response headers.
PoC
Step 1
start Granian with the PoC WSGI app
# app.py
def app(environ, start_response):
path = environ.get("PATH_INFO", "/")
if path == "/crash-name":
headers = [("X Bad Name", "value")]
elif path == "/crash-value":
headers = [("Content-Type", "text/html\r\nX-Injected: evil")]
elif path == "/crash-null":
headers = [("X-Custom", "value\x00end")]
else:
start_response("200 OK", [("Content-Type", "text/plain")])
return [b"OK - server alive\n"]
start_response("200 OK", headers)
return [b"This response kills the worker\n"]
granian --interface wsgi app:app --host 127.0.0.1 --port 8000
Step 2
trigger the crash (any one of these is sufficient)
curl http://127.0.0.1:8000/crash-name
curl http://127.0.0.1:8000/crash-value
curl http://127.0.0.1:8000/crash-null
Expected result:
- the worker aborts after any of the crash paths
- subsequent requests fail until the worker is restarted
Impact
- Worker process denial of service
- A single bad response kills one worker
- Application bugs become process crashes instead of request-scoped failures
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "granian"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.0"
},
{
"fixed": "2.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42545"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-755"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T21:24:56Z",
"nvd_published_at": "2026-05-12T22:16:34Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nGranian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses `.unwrap()` on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error.\n\nThis issue requires a buggy or attacker-influenced WSGI application to emit invalid headers. It is not a parser bug in Granian\u0027s request path. The security impact is that application mistakes which should result in a `500` instead kill the worker process.\n\n### Details\n\nhttps://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/wsgi/io.rs#L39-L42\n\nIf either conversion fails, `.unwrap()` panics. In release builds Granian uses `panic = \"abort\"`, so the panic terminates the worker.\n\n\n#### Preconditions\n\nThe attacker must be able to influence a header name or value produced by the WSGI application, or the application must otherwise generate invalid headers.\n\nExamples include:\n\n- a header name containing a space\n- a header value containing `\\r\\n`\n- a header value containing a null byte\n\nThese are realistic failure modes for applications that reflect user-controlled data into headers such as `Location`, `Content Disposition`, or custom response headers.\n\n### PoC\n\n#### Step 1\n\nstart Granian with the PoC WSGI app\n\n```python\n# app.py\ndef app(environ, start_response):\n path = environ.get(\"PATH_INFO\", \"/\")\n if path == \"/crash-name\":\n headers = [(\"X Bad Name\", \"value\")]\n elif path == \"/crash-value\":\n headers = [(\"Content-Type\", \"text/html\\r\\nX-Injected: evil\")]\n elif path == \"/crash-null\":\n headers = [(\"X-Custom\", \"value\\x00end\")]\n else:\n start_response(\"200 OK\", [(\"Content-Type\", \"text/plain\")])\n return [b\"OK - server alive\\n\"]\n\n start_response(\"200 OK\", headers)\n return [b\"This response kills the worker\\n\"]\n\n```\n\n```bash\ngranian --interface wsgi app:app --host 127.0.0.1 --port 8000\n```\n\n#### Step 2\n\ntrigger the crash (any one of these is sufficient)\n\n```bash\ncurl http://127.0.0.1:8000/crash-name\ncurl http://127.0.0.1:8000/crash-value\ncurl http://127.0.0.1:8000/crash-null\n```\n\n\nExpected result:\n\n- the worker aborts after any of the crash paths\n- subsequent requests fail until the worker is restarted\n\n\n### Impact\n\n- Worker process denial of service\n- A single bad response kills one worker\n- Application bugs become process crashes instead of request-scoped failures",
"id": "GHSA-f5p7-9fr5-8jmj",
"modified": "2026-05-13T16:41:31Z",
"published": "2026-05-06T21:24:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42545"
},
{
"type": "PACKAGE",
"url": "https://github.com/emmett-framework/granian"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Granian vulnerable to DoS via WSGI response header panic"
}
GHSA-F5X9-8JWC-25RW
Vulnerability from github – Published: 2022-06-02 20:37 – Updated: 2024-11-19 16:18
VLAI
Summary
Uncaught Exception (due to a data race) leads to process termination in Waitress
Details
Impact
Waitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.
Patches
This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket, instead it is always delegated to the main thread.
Workarounds
There is no work-around, however users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
For more information
If you have any questions or comments about this advisory: * Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related) * email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "waitress"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31015"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-02T20:37:48Z",
"nvd_published_at": "2022-05-31T23:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nWaitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.\n\n### Patches\n\nThis issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket, instead it is always delegated to the main thread.\n\n### Workarounds\n\nThere is no work-around, however users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (if security related)\n",
"id": "GHSA-f5x9-8jwc-25rw",
"modified": "2024-11-19T16:18:32Z",
"published": "2022-06-02T20:37:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31015"
},
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/issues/374"
},
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/pull/377"
},
{
"type": "WEB",
"url": "https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48"
},
{
"type": "PACKAGE",
"url": "https://github.com/Pylons/waitress"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2022-205.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Uncaught Exception (due to a data race) leads to process termination in Waitress"
}
GHSA-F67Q-WR6W-23JQ
Vulnerability from github – Published: 2024-08-14 20:49 – Updated: 2025-12-20 05:28
VLAI
Summary
Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
Details
A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts.
Details
Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by methods of AsyncGenerator such as %AsyncGeneratorPrototype%.next, %AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.
However, a carefully constructed code could trigger a state transition from a getter method for the promise's then property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.
Patches
Version 0.19.0 is patched to correctly handle this case.
Workarounds
Users unable to upgrade to the patched version would want to use std::panic::catch_unwind to ensure any exceptions caused by the engine don't impact the availability of the main application.
References
- https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7
- https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "boa_engine"
},
"ranges": [
{
"events": [
{
"introduced": "0.16"
},
{
"fixed": "0.19.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-43367"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-14T20:49:51Z",
"nvd_published_at": "2024-08-15T21:15:17Z",
"severity": "HIGH"
},
"details": "A wrong assumption made when handling ECMAScript\u0027s `AsyncGenerator` operations can cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa\u0027s implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`.\nHowever, a carefully constructed code could trigger a state transition from a getter method for the promise\u0027s `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use [`std::panic::catch_unwind`](https://doc.rust-lang.org/std/panic/fn.catch_unwind.html) to ensure any exceptions caused by the engine don\u0027t impact the availability of the main application.\n\n## References\n\n- https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7\n- https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r",
"id": "GHSA-f67q-wr6w-23jq",
"modified": "2025-12-20T05:28:05Z",
"published": "2024-08-14T20:49:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq"
},
{
"type": "WEB",
"url": "https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43367"
},
{
"type": "WEB",
"url": "https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7"
},
{
"type": "PACKAGE",
"url": "https://github.com/boa-dev/boa"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0444.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects"
}
GHSA-F7Q6-7RQ9-3PHX
Vulnerability from github – Published: 2026-07-18 15:31 – Updated: 2026-09-04 19:39
VLAI
Summary
Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m24x-r6q3-2vp9. This link is maintained to preserve external references.
Original Description
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.1.0"
},
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-04T19:39:23Z",
"nvd_published_at": "2026-07-18T14:17:09Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-m24x-r6q3-2vp9. This link is maintained to preserve external references.\n\n## Original Description\nSurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.",
"id": "GHSA-f7q6-7rq9-3phx",
"modified": "2026-09-04T19:39:24Z",
"published": "2026-07-18T15:31:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58368"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB",
"withdrawn": "2026-09-04T19:39:23Z"
}
GHSA-F9VX-6CFW-VGPG
Vulnerability from github – Published: 2023-04-19 21:30 – Updated: 2024-04-04 03:35
VLAI
Details
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261723753
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-21087"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-19T20:15:11Z",
"severity": "MODERATE"
},
"details": "In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261723753",
"id": "GHSA-f9vx-6cfw-vgpg",
"modified": "2024-04-04T03:35:57Z",
"published": "2023-04-19T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21087"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-04-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F9XV-Q969-PQX4
Vulnerability from github – Published: 2023-04-24 15:30 – Updated: 2023-05-03 18:36
VLAI
Summary
Uncaught Exception in yaml
Details
Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "yaml"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-5"
},
{
"fixed": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-2251"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-24T18:05:30Z",
"nvd_published_at": "2023-04-24T15:15:08Z",
"severity": "HIGH"
},
"details": "Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.",
"id": "GHSA-f9xv-q969-pqx4",
"modified": "2023-05-03T18:36:52Z",
"published": "2023-04-24T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2251"
},
{
"type": "WEB",
"url": "https://github.com/eemeli/yaml/commit/984f5781ffd807e58cad3b5c8da1f940dab75fba"
},
{
"type": "PACKAGE",
"url": "https://github.com/eemeli/yaml"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/4b494e99-5a3e-40d9-8678-277f3060e96c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncaught Exception in yaml"
}
GHSA-FFCV-V6PW-QHRP
Vulnerability from github – Published: 2024-10-08 22:18 – Updated: 2024-10-31 19:31
VLAI
Summary
Denial of Service in TYPO3 Bookmark Toolbar
Details
Problem
Due to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account.
Solution
Update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described.
Credits
Thanks to Hendrik Eichner who reported this issue and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-backend"
},
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"13.0.0"
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c 12.4.20"
},
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-backend"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.5.39"
},
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-backend"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.4.45"
},
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-backend"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.46"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34537"
],
"database_specific": {
"cwe_ids": [
"CWE-1286",
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-08T22:18:27Z",
"nvd_published_at": "2024-10-28T14:15:04Z",
"severity": "LOW"
},
"details": "### Problem\nDue to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account.\n\n### Solution\nUpdate to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described.\n\n### Credits\nThanks to Hendrik Eichner who reported this issue and to TYPO3 core \u0026 security team members Oliver Hader and Benjamin Franzke who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2024-011](https://typo3.org/security/advisory/typo3-core-sa-2024-001)\n",
"id": "GHSA-ffcv-v6pw-qhrp",
"modified": "2024-10-31T19:31:10Z",
"published": "2024-10-08T22:18:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-ffcv-v6pw-qhrp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34537"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3-CMS/backend"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2024-011"
},
{
"type": "WEB",
"url": "https://www.mgm-sp.com/cve/denial-of-service-in-typo3-bookmark-toolbar"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:F/RL:O/RC:C",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Denial of Service in TYPO3 Bookmark Toolbar"
}
GHSA-FFPF-5H29-W36W
Vulnerability from github – Published: 2024-03-21 06:33 – Updated: 2025-11-04 18:30
VLAI
Details
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-28835"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T06:15:45Z",
"severity": "MODERATE"
},
"details": "A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the \"certtool --verify-chain\" command.",
"id": "GHSA-ffpf-5h29-w36w",
"modified": "2025-11-04T18:30:46Z",
"published": "2024-03-21T06:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28835"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1879"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2570"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2889"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-28835"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269084"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00019.html"
},
{
"type": "WEB",
"url": "https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241122-0009"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/22/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/22/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.