Common Weakness Enumeration

CWE-696

Weakness Allowed-with-Review

Incorrect Behavior Order

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Mapping guidance

This CWE entry is a Class and might have Base-level children that would be more appropriate

Examine children of this entry to see if there is a better fit

Relationships and members
ChildOf: CWE-691 · View CWE-1000
Modes of introduction
Architecture and Design
Implementation
Content history
Submission: CWE Content Team · MITRE · 2008-09-09 · CWE 1.0
Modification: CWE Content Team · MITRE · 2008-11-24 · CWE 1.1

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2009-05-27 · CWE 1.4

updated Description

Modification: CWE Content Team · MITRE · 2011-03-29 · CWE 1.12

updated Relationships

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2011-06-27 · CWE 2.0

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Related_Attack_Patterns, Relationships, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships

Modification: CWE Content Team · MITRE · 2017-05-03 · CWE 2.11

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Description, Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2021-03-15 · CWE 4.4

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Demonstrative_Examples, Observed_Examples

Modification: CWE Content Team · MITRE · 2024-02-29 · CWE 4.14

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Relationships

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Description

121 vulnerabilities reference this CWE, most recent first.

CVE-2026-128087 (GCVE-0-2026-128087)

Vulnerability from cvelistv5 – Published: 2026-11-13 19:03 – Updated: 2026-11-13 21:15
VLAI
Title
russh kex_done: shared-secret callback runs before server host-key verification
Summary
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback's no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1.
Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:15 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
  • CWE-863 - Incorrect Authorization
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7868 records in the last 180 days details
References
Impacted products
Vendor Product Version
Eugeny russh Affected: >= 0.55.0, < 0.65.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-128087",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:15:11.345733Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:15:30.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.55.0, \u003c 0.65.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback\u0027s no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:03:26.702Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f"
        },
        {
          "name": "https://github.com/Eugeny/russh/pull/808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/pull/808"
        },
        {
          "name": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/commit/43a46d67a80a7355fcd2fb25e7e00d79aec8184c"
        },
        {
          "name": "https://github.com/Eugeny/russh/releases/tag/v0.65.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Eugeny/russh/releases/tag/v0.65.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9264-jvgf-6w2f",
        "discovery": "UNKNOWN"
      },
      "title": "russh kex_done: shared-secret callback runs before server host-key verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-128087",
    "datePublished": "2026-11-13T19:03:26.702Z",
    "dateReserved": "2026-11-12T21:24:51.131Z",
    "dateUpdated": "2026-11-13T21:15:30.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124761 (GCVE-0-2026-124761)

Vulnerability from cvelistv5 – Published: 2026-11-13 13:24 – Updated: 2026-11-13 13:24
VLAI
Title
A DCP Set of the IP suite that is refused is still stored
Summary
P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.
Severity
7.1 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
rt-labs CNA under the ENISA root
CNA scorecard B 75/100 over 20 records in the last 180 days details
References
Impacted products
Vendor Product Version
RT-Labs P-Net Affected: 0 , < 1.0.4 (semver)
Create a notification for this product.
Credits
Aditya Gupta (Attify - attify.com)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "P-Net",
          "vendor": "RT-Labs",
          "versions": [
            {
              "lessThan": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aditya Gupta (Attify - attify.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eP-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.\u003c/p\u003e"
            }
          ],
          "value": "P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T13:24:02.359Z",
        "orgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
        "shortName": "rt-labs"
      },
      "references": [
        {
          "name": "Cybersecurity advisory for P-Net",
          "url": "https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to P-Net 1.0.4 or later.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to P-Net 1.0.4 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A DCP Set of the IP suite that is refused is still stored"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
    "assignerShortName": "rt-labs",
    "cveId": "CVE-2026-124761",
    "datePublished": "2026-11-13T13:24:02.359Z",
    "dateReserved": "2026-11-09T12:48:59.072Z",
    "dateUpdated": "2026-11-13T13:24:02.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123612 (GCVE-0-2026-123612)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-12 13:40
VLAI
Title
rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure
Summary
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.
Severity
4.6 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 13:38 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 8190 records in the last 180 days details
References
Impacted products
Vendor Product Version
rustls rustls Affected: 0.23.44 , < 0.23.46 (semver)
Unaffected: 0.23.46 (semver)
    cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-14 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T13:38:50.344082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T13:40:04.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rustls",
          "product": "rustls",
          "vendor": "rustls",
          "versions": [
            {
              "lessThan": "0.23.46",
              "status": "affected",
              "version": "0.23.44",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.23.46",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustls_project:rustls:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.23.46",
                  "versionStartIncluding": "0.23.44",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:36.873Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vp88-798v-h67f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/rustls/rustls/security/advisories/GHSA-vp88-798v-h67f"
        },
        {
          "name": "VulnCheck Advisory: rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rustls-0.23.44-and-0.23.45-ech-rejection-application-data-disclosure"
        }
      ],
      "title": "rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123612",
    "datePublished": "2026-11-08T01:38:36.873Z",
    "dateReserved": "2026-11-06T01:02:39.794Z",
    "dateUpdated": "2026-11-12T13:40:04.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123584 (GCVE-0-2026-123584)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-12 13:14
VLAI
Title
Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses
Summary
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 13:13 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 8190 records in the last 180 days details
References
Impacted products
Vendor Product Version
hickory-dns hickory-dns Affected: 0.26.0 , < 0.26.2 (semver)
Unaffected: 0.26.2 (semver)
Create a notification for this product.
Date Public
2026-09-03 00:00
Credits
qifan-sailboat
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T13:13:27.750747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T13:14:32.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/hickory-net",
          "product": "hickory-dns",
          "vendor": "hickory-dns",
          "versions": [
            {
              "lessThan": "0.26.2",
              "status": "affected",
              "version": "0.26.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.26.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "qifan-sailboat"
        }
      ],
      "datePublic": "2026-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query\u0027s source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:38:17.587Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v44v-c8m4-gc43)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43"
        },
        {
          "name": "VulnCheck Advisory: Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-udp-client-denial-of-service-via-spoofed-responses"
        }
      ],
      "title": "Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123584",
    "datePublished": "2026-11-08T01:38:17.587Z",
    "dateReserved": "2026-11-06T00:55:55.661Z",
    "dateUpdated": "2026-11-12T13:14:32.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121291 (GCVE-0-2026-121291)

Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:27
VLAI
Title
Security Advisory 0222
Summary
A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:27 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
Arista CNA under the mitre root
CNA scorecard B 87/100 over 116 records in the last 180 days details
References
Impacted products
Vendor Product Version
Arista Networks EOS Affected: 4.37.0F (custom)
Affected: 4.36.0F , ≤ 4.36.2F (custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:27:27.385133Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:27:40.172Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6/XE7 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "ZTX-7200 Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange, virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "status": "affected",
              "version": "4.37.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.36.2F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.6M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eswitch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n     rpki cache \u003ccache-name\u003e\n        host \u003ccache-address\u003e\u003c/pre\u003e"
            }
          ],
          "value": "switch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n     rpki cache \u003ccache-name\u003e\n        host \u003ccache-address\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-21",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-21 Exploitation of Trusted Credentials"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T20:09:57.730Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"
        }
      ],
      "source": {
        "advisory": "Security Advisory 0222",
        "defects": [
          "1936844"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0222"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-121291",
    "datePublished": "2026-11-10T20:09:57.730Z",
    "dateReserved": "2026-11-03T11:21:01.892Z",
    "dateUpdated": "2026-11-13T17:27:40.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120490 (GCVE-0-2026-120490)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:01 – Updated: 2026-11-12 14:01
VLAI
Title
Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms
Summary
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.
Severity
3.8 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-696 - Incorrect Behavior Order.
Assigner
checkpoint CNA under the mitre root
CNA scorecard C 66/100 over 20 records in the last 180 days details
References
Impacted products
Vendor Product Version
checkpoint Scalable Platforms (ElasticXL, Maestro, Chassis) Affected: R82 with Jumbo Hotfix Take 130 or below
Affected: R81.20 with Jumbo Hotfix Take 173 or below
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Scalable Platforms (ElasticXL, Maestro, Chassis)",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 130 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 173 or below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway\u0027s Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:01:48.152Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "url": "https://support.checkpoint.com/results/sk/sk1000364"
        }
      ],
      "title": "Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2026-120490",
    "datePublished": "2026-11-12T14:01:48.152Z",
    "dateReserved": "2026-11-02T14:05:57.337Z",
    "dateUpdated": "2026-11-12T14:01:48.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114145 (GCVE-0-2026-114145)

Vulnerability from cvelistv5 – Published: 2026-10-21 20:35 – Updated: 2026-10-23 15:08
VLAI
Title
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
Summary
GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:54 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7868 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:54:12.373636Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T15:08:48.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GitPython",
          "vendor": "gitpython-developers",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T20:35:06.548Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7"
        },
        {
          "name": "https://github.com/gitpython-developers/GitPython/pull/2264",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gitpython-developers/GitPython/pull/2264"
        },
        {
          "name": "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697"
        },
        {
          "name": "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-83vg-56qc-22m7",
        "discovery": "UNKNOWN"
      },
      "title": "GitPython validates a submodule\u0027s \".git\" path only after cloning into it (RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114145",
    "datePublished": "2026-10-21T20:35:06.548Z",
    "dateReserved": "2026-10-20T21:53:58.474Z",
    "dateUpdated": "2026-10-23T15:08:48.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112186 (GCVE-0-2026-112186)

Vulnerability from cvelistv5 – Published: 2026-11-10 17:02 – Updated: 2026-11-10 17:02
VLAI
Summary
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CWE
Assigner
eclipse CNA under the mitre root
CNA scorecard C 66/100 over 219 records in the last 180 days details
References
Impacted products
Vendor Product Version
Eclipse Foundation Eclipse Kura Affected: 5.4.0 , ≤ 5.6.2 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eclipse Kura",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThanOrEqual": "5.6.2",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.\u003c/p\u003e"
            }
          ],
          "value": "In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:02:46.279Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "url": "https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2026-112186",
    "datePublished": "2026-11-10T17:02:46.279Z",
    "dateReserved": "2026-10-19T09:21:22.208Z",
    "dateUpdated": "2026-11-10T17:02:46.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110450 (GCVE-0-2026-110450)

Vulnerability from cvelistv5 – Published: 2026-10-14 04:03 – Updated: 2026-10-19 19:03
VLAI
Summary
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
Severity
8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:03 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
mitre CNA under the mitre root
CNA scorecard E 29/100 over 2132 records in the last 180 days details
References
Impacted products
Vendor Product Version
NixOS Nix Affected: 0 , < 2.28.8 (semver)
Affected: 2.29.0 , < 2.30.6 (semver)
Affected: 2.31.0 , < 2.31.6 (semver)
Affected: 2.32.0 , < 2.34.9 (semver)
Affected: 2.35.0 , < 2.35.3 (semver)
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T19:03:38.040394Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:03:52.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nix",
          "vendor": "NixOS",
          "versions": [
            {
              "lessThan": "2.28.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.30.6",
              "status": "affected",
              "version": "2.29.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.31.6",
              "status": "affected",
              "version": "2.31.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.34.9",
              "status": "affected",
              "version": "2.32.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.35.3",
              "status": "affected",
              "version": "2.35.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.28.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.30.6",
                  "versionStartIncluding": "2.29.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.31.6",
                  "versionStartIncluding": "2.31.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.34.9",
                  "versionStartIncluding": "2.32.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.35.3",
                  "versionStartIncluding": "2.35.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T04:03:12.768Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-110450",
    "datePublished": "2026-10-14T04:03:12.768Z",
    "dateReserved": "2026-10-14T04:03:11.878Z",
    "dateUpdated": "2026-10-19T19:03:52.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109162 (GCVE-0-2026-109162)

Vulnerability from cvelistv5 – Published: 2026-10-13 09:27 – Updated: 2026-10-16 17:17
VLAI
Title
TYPO3 CMS - Security Misconfiguration in Form Framework
Summary
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 17:01 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
  • CWE-552 - Files or directories accessible to external parties
Assigner
TYPO3 CNA under the mitre root
CNA scorecard B 83/100 over 66 records in the last 180 days details
References
Impacted products
Vendor Product Version
TYPO3 TYPO3 CMS Affected: 14.0.0 , < 14.3.9 (semver)
    cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Bejo ning Eurico Nicacio Josua Vogel
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T17:01:48.615569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:17:41.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Form Framework"
          ],
          "packageName": "typo3/cms-form",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "14.3.9",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3_cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.9",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bejo ning"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eurico Nicacio"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Josua Vogel"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Forms using \u003ci\u003eFileUpload\u003c/i\u003e or \u003ci\u003eImageUpload\u003c/i\u003e elements with a custom \u003ci\u003esaveToFileMount\u003c/i\u003e configured stored uploaded files in the default storage folder \u003ci\u003e1:/user_upload/\u003c/i\u003e instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for \u003ci\u003esaveToFileMount\u003c/i\u003e are not affected.\u0026nbsp;\u003cspan\u003eThis issue affects TYPO3 CMS versions 14.0.0-14.3.8.\u003c/span\u003e"
            }
          ],
          "value": "Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected.\u00a0This issue affects TYPO3 CMS versions 14.0.0-14.3.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696 Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or directories accessible to external parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T08:56:40.570Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-024"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/cc3e8e28b0e830aaf6ad857272f3f2dc3c4ede12"
        },
        {
          "name": "Git commit of 14.3 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/f536f75c6bd3456165e4200e5df1b236ddeae3b0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Security Misconfiguration in Form Framework",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-109162",
    "datePublished": "2026-10-13T09:27:24.320Z",
    "dateReserved": "2026-10-12T12:26:08.379Z",
    "dateUpdated": "2026-10-16T17:17:41.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-463: Padding Oracle Crypto Attack

An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.

← Back to the CWE list