CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2024-8353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-28T02:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like \u0027give_title\u0027 and \u0027card_address\u0027. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.",
  "id": "GHSA-vpc6-qr46-3mw7",
  "modified": "2024-10-01T15:32:04Z",
  "published": "2024-09-28T03:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8353"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-donation.php#L154"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/src/Helpers/Utils.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-mina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-mina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.15.0"
            },
            {
              "fixed": "4.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-mina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "4.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:19:01Z",
    "nvd_published_at": "2026-04-27T09:16:01Z",
    "severity": "HIGH"
  },
  "details": "The camel-mina component\u0027s MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject().\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.",
  "id": "GHSA-vpr3-2659-rw55",
  "modified": "2026-05-05T21:19:01Z",
  "published": "2026-04-27T09:34:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40473"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/22583"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/22584"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/22585"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/8e7f6335d2b4b096df26f8221723405ceaee275a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/b605816d11c253d22989abc290c198be83e3f817"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/c35b0a3720f8c80025b06112d5d9c2932426d7f0"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2026-40473.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-23319"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/26/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Camel-MINA Vulnerable to Deserialization of Untrusted Data"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-53909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-24T21:15:03Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.",
  "id": "GHSA-vq3g-vjx5-h9p5",
  "modified": "2024-11-24T21:30:46Z",
  "published": "2024-11-24T21:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53909"
    },
    {
      "type": "WEB",
      "url": "https://www.veritas.com/content/support/en_US/security/VTS24-014"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-44371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-07T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).",
  "id": "GHSA-vq5r-ghv4-w862",
  "modified": "2022-12-09T15:30:29Z",
  "published": "2022-12-07T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/java-aodeng/hope-boot/issues/83"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-51743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-25T21:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.",
  "id": "GHSA-vq83-4r5v-j6xx",
  "modified": "2025-11-26T15:34:11Z",
  "published": "2025-11-25T21:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51743"
    },
    {
      "type": "WEB",
      "url": "https://blog.hackpax.top/jsh-erp2"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/jishenghua"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/jishenghua/JSH_ERP"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24974"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T17:16:39Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through \u003c= 3.7.1.",
  "id": "GHSA-vqjh-xqjg-g4p7",
  "modified": "2026-03-26T18:31:33Z",
  "published": "2026-03-25T18:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24974"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-1-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T15:24:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nUsing pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.\n\n### Details\nThe attack payload executes in the following steps:\nFirst, the attacker craft the payload by calling to `pty.spawn` function in the `__reduce__` method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -\n```\n----------- SCAN SUMMARY -----------\nScanned files: 1\nInfected files: 0\nDangerous globals: 0\n```\nThe victim proceeds to load the pickle file and execute attacker-injected arbitrary code.\n\n### PoC\n```\nclass PtyExploit:\n  def __reduce__(self):\n    return (pty.spawn, ([\"/bin/sh\", \"-c\", \"id; exit\"],))\n```\n\n### Impact\n**Who is impacted?** Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\n**What is the impact?** Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\n**Supply Chain Attack**: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Collaborators\nhttps://github.com/ajohnston9\nhttps://github.com/geo-lit",
  "id": "GHSA-vqmv-47xg-9wpr",
  "modified": "2025-12-29T15:24:33Z",
  "published": "2025-12-29T15:24:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vqmv-47xg-9wpr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Picklescan missing detection when calling pty.spawn"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.amqp:spring-amqp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.amqp:spring-amqp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.amqp:spring-amqp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-8045"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-30T21:12:41Z",
    "nvd_published_at": "2017-11-27T10:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.",
  "id": "GHSA-vqqg-xgv7-cf68",
  "modified": "2022-06-30T21:12:41Z",
  "published": "2022-05-17T00:16:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8045"
    },
    {
      "type": "WEB",
      "url": "https://pivotal.io/security/cve-2017-8045"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100936"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in Spring AMQP"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.21.0"
            },
            {
              "fixed": "2.48.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-22T18:02:45Z",
    "nvd_published_at": "2026-01-22T16:16:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in `docling-core \u003e=2.21.0, \u003c2.48.4` and, specifically only if the application uses `pyyaml \u003c 5.4` and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data.\n\n### Patches\n\nThe vulnerability has been patched in `docling-core` version **2.48.4**.\nThe fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution.\n\n### Workarounds\n\nUsers who cannot immediately upgrade `docling-core` can alternatively ensure that the installed version of `PyYAML` is **5.4 or greater**, which supposedly patches CVE-2020-14343.\n\n### References\n\n* GitHub Issue: #482\n* Upstream Advisory: CVE-2020-14343\n* Fix Release: [v2.48.4](https://github.com/docling-project/docling-core/releases/tag/v2.48.4)",
  "id": "GHSA-vqxf-v2gg-x3hc",
  "modified": "2026-01-22T18:43:42Z",
  "published": "2026-01-22T18:02:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/security/advisories/GHSA-vqxf-v2gg-x3hc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24009"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/issues/482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8q59-q68h-6hv4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/releases/tag/v2.48.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.clojure:clojure"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.clojure:clojure"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.12.0-alpha1"
            },
            {
              "fixed": "1.12.0-alpha9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-01T16:56:52Z",
    "nvd_published_at": "2024-02-29T02:15:09Z",
    "severity": "HIGH"
  },
  "details": "Any program on the JVM may read serialized objects via [java.io.ObjectInputStream.readObject()](https://docs.oracle.com/javase/8/docs/api/java/io/ObjectInputStream.html#readObject--). Reading serialized objects from an untrusted source is **inherently unsafe** (this affects any program running on any version of the JVM) and is a prerequisite for this vulnerability.\n\nClojure classes that represent infinite seqs (Cycle, infinite Repeat, and Iterate) do not define hashCode() and use the parent ASeq.hashCode(), which walks the seq to compute the hash, yielding an infinite loop. Classes like java.util.HashMap call hashCode() on keys during deserialization of a serialized map. \n\nThe exploit requires:\n\n1. Crafting a serialized HashMap object with an infinite seq object as a key.\n2. Sending that to a program that reads serialized objects via ObjectInputStream.readObject().\n\nThis will cause the program to enter an infinite loop on the reading thread and thus a denial of service (DoS). \n\nThe affected Clojure classes (Cycle, Repeat, Iterate) exist in Clojure 1.7.0-1.11.1, 1.12.0-alpha1-1.12.0-alpha8.",
  "id": "GHSA-vr64-r9qj-h27f",
  "modified": "2025-11-05T00:31:17Z",
  "published": "2024-02-29T03:33:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22871"
    },
    {
      "type": "WEB",
      "url": "https://clojure.atlassian.net/browse/CLJ-2839"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/clojure/clojure"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/%40fe1w0/rymmJGida"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service"
}