Monthly
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
GnuPG ships a memory-handling flaw in its OpenPGP ASCII-armor decoder that a remote attacker can trigger only by getting a victim to locally process a crafted armored input (a file, message, or piped stream handed to gpg), where a buffer-copy loop can over-run or read past the intended output buffer. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R, base 7.0 HIGH) reflects a real but constrained impact: local processing is required, the vulnerable buffer state is difficult to reach reliably, and the victim must actually run gpg against the attacker-supplied data, while NVD's own vector is even more conservative (AV:L/AC:H/PR:L). Alpine Linux fixed the packaged issue in gnupg 2.4.9-r0 and upstream fixed the code in the commit that shipped with GnuPG 2.2.51; EPSS is negligible at 0.02% (4th percentile) and no public exploit identified at time of analysis.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
GnuPG ships a memory-handling flaw in its OpenPGP ASCII-armor decoder that a remote attacker can trigger only by getting a victim to locally process a crafted armored input (a file, message, or piped stream handed to gpg), where a buffer-copy loop can over-run or read past the intended output buffer. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R, base 7.0 HIGH) reflects a real but constrained impact: local processing is required, the vulnerable buffer state is difficult to reach reliably, and the victim must actually run gpg against the attacker-supplied data, while NVD's own vector is even more conservative (AV:L/AC:H/PR:L). Alpine Linux fixed the packaged issue in gnupg 2.4.9-r0 and upstream fixed the code in the commit that shipped with GnuPG 2.2.51; EPSS is negligible at 0.02% (4th percentile) and no public exploit identified at time of analysis.