Monthly
HTTP/2 resource-limit bypass in the Elixir Bandit web server (1.9.0 through 1.13.x) lets an unauthenticated remote client exceed the configured max_concurrent_streams and max_requests caps by packing multiple HEADERS frames into a single TCP write where one frame raises a StreamError, causing the handler to continue from pre-chunk connection state. Because stream counts, last_stream_id, rapid-reset timestamps and the HPACK decoder state are all rolled back while the already-started Plug calls keep running, an attacker can drive roughly five times the intended number of concurrent Plug invocations per connection (50 running against a limit of 10 in the reporter's test), exhausting server processes, CPU and memory. Impact is strictly availability - no confidentiality or integrity loss - HTTP/2 with a finite max_concurrent_streams is the default for Bandit's TLS/h2 listeners, no public exploit code is confirmed, and a vendor patch is available.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.
State corruption in UltraDAG 0.1 allows remote unauthenticated attackers to bypass authorization controls and manipulate blockchain state integrity through malformed SmartOp::Vote transactions. The vulnerability enables attackers to trigger state mutations before authorization checks complete, causing high availability impact and low integrity impact to the blockchain. No active exploitation or public POC has been identified, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation against default configurations. Upstream fixes are available via GitHub commits but no tagged release version has been confirmed.
Permanent deletion of existing vulnerability records in GitLab EE is possible for authenticated users holding only read-only permissions when a specific error-handling path is triggered, because cleanup logic fails to distinguish pre-existing records from newly created ones. The issue affects GitLab EE from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, and is rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) with high attack complexity and only low integrity impact. There is no public exploit identified at time of analysis, and the independent assessment classifies this as a low-severity, low-priority issue.
A local denial-of-service condition affects Ghidra versions before 12.1.4, where the software-suite's OptionsDB.createUnregisteredOption() routine fails to validate the TYPE_COL byte of an imported program database, triggering an ArrayIndexOutOfBoundsException. The exception path skips the lock-release logic in AbstractTransactionManager, leaving domain objects permanently locked so the application stalls and cannot clean up resources or shut down gracefully. Exploitation is not remote: it requires a Ghidra operator to be socially engineered into importing a maliciously crafted program database file (CVSS 4.0 base 6.8, AV:L/UI:P, availability-only impact), and no authentication or special configuration is needed. At time of analysis there is no public exploit code identified and no evidence of active exploitation, so this is best treated as a genuine but low-priority availability bug rather than a critical flaw.
Snipe-IT before version 8.7.0 permanently destroys its database when a superuser uploads a corrupted or invalid ZIP archive to the backup restore endpoint, because the wipe operation executes before input validation occurs. The root cause is a validate-after-act ordering flaw (CWE-460): the restore workflow irreversibly clears the database first, then attempts to parse the archive - leaving no rollback path on failure. Exploitation requires superuser privileges and deliberate file upload (CVSS 4.0 PR:H/UI:P), but the consequence is total, unrecoverable data loss for the affected Snipe-IT instance.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.
Unconstrained outbound JWKS requests in PyJWT's PyJWKClient.get_signing_key() allow unauthenticated remote attackers to amplify HTTP traffic toward a downstream JWKS endpoint by submitting JWTs carrying arbitrary, unrecognized kid values. All PyJWT versions prior to 2.13.0 are affected when the PyJWKClient class is used for signature verification. The availability impact is low (CVSS A:L) and exploitation success is gated on the upstream JWKS provider exhibiting rate limiting or transient failures; no public exploit code exists and this CVE does not appear in CISA KEV.
Syft versions before v1.42.3 fail to properly clean up temporary files when temporary storage becomes exhausted during archive scanning, allowing an attacker to trigger a denial of service by exhausting the system's temporary storage through highly compressed or large artifacts. This affects all users of Syft who scan untrusted or adversarially-crafted archives, as the vulnerability requires no authentication and can be triggered remotely through the normal scanning interface. The vulnerability has been patched in v1.42.3 and no active exploitation has been reported in the wild, though the attack vector is straightforward and does not require special privileges.
Network interface denial of service in Cisco IOS XR on NCS 5500/5700 routers allows unauthenticated remote attackers to disable packet processing by sending crafted traffic that triggers EPNI Aligner interrupt corruption during heavy transit conditions. Successful exploitation causes the network processing unit and ASIC to stop functioning, rendering affected interfaces unable to forward traffic. No patch is currently available for this medium-severity vulnerability.
HTTP/2 resource-limit bypass in the Elixir Bandit web server (1.9.0 through 1.13.x) lets an unauthenticated remote client exceed the configured max_concurrent_streams and max_requests caps by packing multiple HEADERS frames into a single TCP write where one frame raises a StreamError, causing the handler to continue from pre-chunk connection state. Because stream counts, last_stream_id, rapid-reset timestamps and the HPACK decoder state are all rolled back while the already-started Plug calls keep running, an attacker can drive roughly five times the intended number of concurrent Plug invocations per connection (50 running against a limit of 10 in the reporter's test), exhausting server processes, CPU and memory. Impact is strictly availability - no confidentiality or integrity loss - HTTP/2 with a finite max_concurrent_streams is the default for Bandit's TLS/h2 listeners, no public exploit code is confirmed, and a vendor patch is available.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.
State corruption in UltraDAG 0.1 allows remote unauthenticated attackers to bypass authorization controls and manipulate blockchain state integrity through malformed SmartOp::Vote transactions. The vulnerability enables attackers to trigger state mutations before authorization checks complete, causing high availability impact and low integrity impact to the blockchain. No active exploitation or public POC has been identified, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation against default configurations. Upstream fixes are available via GitHub commits but no tagged release version has been confirmed.
Permanent deletion of existing vulnerability records in GitLab EE is possible for authenticated users holding only read-only permissions when a specific error-handling path is triggered, because cleanup logic fails to distinguish pre-existing records from newly created ones. The issue affects GitLab EE from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, and is rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) with high attack complexity and only low integrity impact. There is no public exploit identified at time of analysis, and the independent assessment classifies this as a low-severity, low-priority issue.
A local denial-of-service condition affects Ghidra versions before 12.1.4, where the software-suite's OptionsDB.createUnregisteredOption() routine fails to validate the TYPE_COL byte of an imported program database, triggering an ArrayIndexOutOfBoundsException. The exception path skips the lock-release logic in AbstractTransactionManager, leaving domain objects permanently locked so the application stalls and cannot clean up resources or shut down gracefully. Exploitation is not remote: it requires a Ghidra operator to be socially engineered into importing a maliciously crafted program database file (CVSS 4.0 base 6.8, AV:L/UI:P, availability-only impact), and no authentication or special configuration is needed. At time of analysis there is no public exploit code identified and no evidence of active exploitation, so this is best treated as a genuine but low-priority availability bug rather than a critical flaw.
Snipe-IT before version 8.7.0 permanently destroys its database when a superuser uploads a corrupted or invalid ZIP archive to the backup restore endpoint, because the wipe operation executes before input validation occurs. The root cause is a validate-after-act ordering flaw (CWE-460): the restore workflow irreversibly clears the database first, then attempts to parse the archive - leaving no rollback path on failure. Exploitation requires superuser privileges and deliberate file upload (CVSS 4.0 PR:H/UI:P), but the consequence is total, unrecoverable data loss for the affected Snipe-IT instance.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.
Unconstrained outbound JWKS requests in PyJWT's PyJWKClient.get_signing_key() allow unauthenticated remote attackers to amplify HTTP traffic toward a downstream JWKS endpoint by submitting JWTs carrying arbitrary, unrecognized kid values. All PyJWT versions prior to 2.13.0 are affected when the PyJWKClient class is used for signature verification. The availability impact is low (CVSS A:L) and exploitation success is gated on the upstream JWKS provider exhibiting rate limiting or transient failures; no public exploit code exists and this CVE does not appear in CISA KEV.
Syft versions before v1.42.3 fail to properly clean up temporary files when temporary storage becomes exhausted during archive scanning, allowing an attacker to trigger a denial of service by exhausting the system's temporary storage through highly compressed or large artifacts. This affects all users of Syft who scan untrusted or adversarially-crafted archives, as the vulnerability requires no authentication and can be triggered remotely through the normal scanning interface. The vulnerability has been patched in v1.42.3 and no active exploitation has been reported in the wild, though the attack vector is straightforward and does not require special privileges.
Network interface denial of service in Cisco IOS XR on NCS 5500/5700 routers allows unauthenticated remote attackers to disable packet processing by sending crafted traffic that triggers EPNI Aligner interrupt corruption during heavy transit conditions. Successful exploitation causes the network processing unit and ASIC to stop functioning, rendering affected interfaces unable to forward traffic. No patch is currently available for this medium-severity vulnerability.