CWE-674

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:12.583434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:34.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.15.2-0.3.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank lanbigking for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested \u003cinclude\u003e directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T12:10:22.136Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:7519",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:7519"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0989"
        },
        {
          "name": "RHBZ#2429933",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T12:36:12.129Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: unbounded relaxng include recursion leading to stack overflow",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, restrict applications using libxml2 from processing untrusted RelaxNG schema files. Implement strict input validation and sanitization for all RelaxNG schema inputs to prevent the parsing of maliciously crafted, deeply nested include directives."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0989",
    "datePublished": "2026-01-15T14:20:23.274Z",
    "dateReserved": "2026-01-15T12:38:51.419Z",
    "dateUpdated": "2026-09-01T12:10:22.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2023-51764",
              "type": "related"
            },
            {
              "destId": "CVE-2023-51766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33263",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33604",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33605",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40013",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40014",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40015",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40017",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40018",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40019",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40203",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40204",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40205",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42007",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42008",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42391",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42392",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42393",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42395",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73208",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73209",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0382",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0382"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T11:55:53Z",
    "dateUpdated": "2026-09-11T11:55:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0382"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0020",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-11T11:55:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0020"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T17:02:48.522453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T17:17:09.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.2.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.1.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:48:16.910Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m7rc-8w7m-r9qr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions"
        }
      ],
      "title": "SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71393",
    "datePublished": "2026-07-18T13:10:12.360Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-28T01:48:16.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:36:25.366763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:36:36.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/ArtifexSoftware/mupdf",
          "product": "mupdf",
          "repo": "https://github.com/ArtifexSoftware/mupdf",
          "vendor": "ArtifexSoftware",
          "versions": [
            {
              "lessThan": "1.27.0-rc1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.27.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ishayu Potey"
        }
      ],
      "datePublic": "2025-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T22:26:09.463Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://bugs.ghostscript.com/show_bug.cgi?id=708840"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "MuPDF \u003c 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71382",
    "datePublished": "2026-06-23T17:21:48.562Z",
    "dateReserved": "2026-06-23T17:14:32.284Z",
    "dateUpdated": "2026-07-14T22:26:09.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T18:09:01.682546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T18:11:38.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.1.2-12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-30T16:50:25.773Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j"
        },
        {
          "name": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec"
        }
      ],
      "source": {
        "advisory": "GHSA-7rvh-xqp3-pr8j",
        "discovery": "UNKNOWN"
      },
      "title": "Magick\u0027s failure to limit MVG mutual references forming a loop"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68950",
    "datePublished": "2025-12-30T16:50:25.773Z",
    "dateReserved": "2025-12-26T16:42:31.665Z",
    "dateUpdated": "2025-12-30T18:11:38.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T18:09:57.470787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T18:11:48.611Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.1.2-12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-30T16:15:10.277Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637"
        },
        {
          "name": "https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb"
        }
      ],
      "source": {
        "advisory": "GHSA-p27m-hp98-6637",
        "discovery": "UNKNOWN"
      },
      "title": "Magick\u0027s failure to limit the depth of SVG file reads caused a DoS attack."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68618",
    "datePublished": "2025-12-30T16:14:24.235Z",
    "dateReserved": "2025-12-19T18:50:09.990Z",
    "dateUpdated": "2025-12-30T18:11:48.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-67899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-15T16:21:16.378389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-15T16:21:23.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-12-15T23:04:11.694Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/12/15/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "uriparser",
          "vendor": "uriparser project",
          "versions": [
            {
              "lessThanOrEqual": "0.9.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:uriparser_project:uriparser:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.9.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-14T22:21:22.895Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/uriparser/uriparser/issues/282"
        },
        {
          "url": "https://github.com/uriparser/uriparser/pull/284"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-67899",
    "datePublished": "2025-12-14T22:17:42.217Z",
    "dateReserved": "2025-12-14T22:17:41.925Z",
    "dateUpdated": "2025-12-15T23:04:11.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-28T18:26:11.800439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-28T18:27:06.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-26T22:23:26.013Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451"
        }
      ],
      "source": {
        "advisory": "GHSA-554w-wpv2-vw27",
        "discovery": "UNKNOWN"
      },
      "title": "node-forge ASN.1 Unbounded Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66031",
    "datePublished": "2025-11-26T22:23:26.013Z",
    "dateReserved": "2025-11-21T01:08:02.614Z",
    "dateUpdated": "2025-11-28T18:27:06.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-61766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-06T17:01:32.362623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-06T17:16:30.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mediawiki-extensions-Bucket",
          "vendor": "weirdgloop",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP\u0027s call stack limit exceeding, and/or increased memory consumption, potentially leading to a denial of service. Version 1.0.0 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T16:07:04.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-r9f2-4jh3-659j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-r9f2-4jh3-659j"
        },
        {
          "name": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/6f4a71d531cb802cdb991d2a4ca7bf8fb691defd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/6f4a71d531cb802cdb991d2a4ca7bf8fb691defd"
        },
        {
          "name": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/blob/ad704120a1660b5929fb5825db1cf85c9c77acf4/includes/Expression/MemberOfExpression.php#L34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/weirdgloop/mediawiki-extensions-Bucket/blob/ad704120a1660b5929fb5825db1cf85c9c77acf4/includes/Expression/MemberOfExpression.php#L34"
        }
      ],
      "source": {
        "advisory": "GHSA-r9f2-4jh3-659j",
        "discovery": "UNKNOWN"
      },
      "title": "Bucket vulnerable to infinite recursion when querying a bucket using the != operator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-61766",
    "datePublished": "2025-10-06T16:07:04.126Z",
    "dateReserved": "2025-09-30T19:43:49.900Z",
    "dateUpdated": "2025-10-06T17:16:30.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}