Monthly
Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current request and the next request received on the same reused keep-alive connection, most likely causing the second request to fail and potentially leaking fragments of the first response to a different client. Remote, unauthenticated attackers can trigger the condition (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1 as published; our assessment raises attack complexity to High because the target must both perform large non-blocking writes and reuse the connection, and the corruption outcome is non-deterministic), so reliable attacker control over which or how much data leaks is not established. No public exploit code and no CISA KEV entry were identified at time of analysis, and 11.0.27 resolves the flaw.
Perl's Text::CSV_XS module (versions before 1.65) contains a buffer under-read in its XS whitespace-stripping routine: when parsing an all-blank field with the non-default allow_whitespace option, cx_strip_trail_whitespace walks backwards past the start of the field's heap buffer, reading and potentially zeroing one byte before it. Reaching that path requires a specific input shape - an unquoted all-blank field preceded by an escape_char that differs from quote_char, or a quoted field in getline whose line ends in two carriage returns - and an allocator layout where the physically preceding byte is itself a space or tab, so the effect is layout-dependent and reliably observable only under valgrind/ASan. Remote unauthenticated attackers who can influence CSV input to an application that enables allow_whitespace are the exposure surface; the impact ranges from a one-byte out-of-bounds read (the CVE's information-disclosure reading, 7.5) to limited memory corruption (I:L/A:L in this independent assessment), and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis, with EPSS low at 0.19% (8th percentile).
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Kernel memory disclosure in OpenTelemetry eBPF Instrumentation (OBI) versions prior to 0.9.0 allows a local authenticated process to exfiltrate arbitrary kernel memory into the OBI telemetry pipeline by supplying a crafted kernel-space pointer to the Java TLS ioctl kprobe. The BPF probe hooks do_vfs_ioctl and incorrectly uses bpf_probe_read - which can dereference any memory address, kernel or user - instead of the boundary-enforcing bpf_probe_read_user, causing the kernel bytes to be emitted via bpf_ringbuf_output into downstream telemetry. Publicly available exploit code exists (PoC published in the GitHub security advisory); no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
A buffer under-read in the Snort 3 HTTP decoder lets unauthenticated, remote attackers crash the detection engine or expose adjacent memory by sending crafted HTTP packets containing malformed MIME header fields. Any deployment where attacker-controlled HTTP traffic is inspected by Snort 3 is exposed - including standalone Snort 3 and Cisco intrusion prevention deployments such as Firepower/FTD that run the Snort 3 engine - and the flaw carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) for high confidentiality and availability impact. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS is low at 0.42% (36th percentile).
A flaw was found in libsoup. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
No proper validation of the length of user input in http_server_get_content_type_from_extension. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current request and the next request received on the same reused keep-alive connection, most likely causing the second request to fail and potentially leaking fragments of the first response to a different client. Remote, unauthenticated attackers can trigger the condition (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1 as published; our assessment raises attack complexity to High because the target must both perform large non-blocking writes and reuse the connection, and the corruption outcome is non-deterministic), so reliable attacker control over which or how much data leaks is not established. No public exploit code and no CISA KEV entry were identified at time of analysis, and 11.0.27 resolves the flaw.
Perl's Text::CSV_XS module (versions before 1.65) contains a buffer under-read in its XS whitespace-stripping routine: when parsing an all-blank field with the non-default allow_whitespace option, cx_strip_trail_whitespace walks backwards past the start of the field's heap buffer, reading and potentially zeroing one byte before it. Reaching that path requires a specific input shape - an unquoted all-blank field preceded by an escape_char that differs from quote_char, or a quoted field in getline whose line ends in two carriage returns - and an allocator layout where the physically preceding byte is itself a space or tab, so the effect is layout-dependent and reliably observable only under valgrind/ASan. Remote unauthenticated attackers who can influence CSV input to an application that enables allow_whitespace are the exposure surface; the impact ranges from a one-byte out-of-bounds read (the CVE's information-disclosure reading, 7.5) to limited memory corruption (I:L/A:L in this independent assessment), and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis, with EPSS low at 0.19% (8th percentile).
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Kernel memory disclosure in OpenTelemetry eBPF Instrumentation (OBI) versions prior to 0.9.0 allows a local authenticated process to exfiltrate arbitrary kernel memory into the OBI telemetry pipeline by supplying a crafted kernel-space pointer to the Java TLS ioctl kprobe. The BPF probe hooks do_vfs_ioctl and incorrectly uses bpf_probe_read - which can dereference any memory address, kernel or user - instead of the boundary-enforcing bpf_probe_read_user, causing the kernel bytes to be emitted via bpf_ringbuf_output into downstream telemetry. Publicly available exploit code exists (PoC published in the GitHub security advisory); no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
A buffer under-read in the Snort 3 HTTP decoder lets unauthenticated, remote attackers crash the detection engine or expose adjacent memory by sending crafted HTTP packets containing malformed MIME header fields. Any deployment where attacker-controlled HTTP traffic is inspected by Snort 3 is exposed - including standalone Snort 3 and Cisco intrusion prevention deployments such as Firepower/FTD that run the Snort 3 engine - and the flaw carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) for high confidentiality and availability impact. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS is low at 0.42% (36th percentile).
A flaw was found in libsoup. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
No proper validation of the length of user input in http_server_get_content_type_from_extension. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.