Monthly
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Denial of service in the Apache Thrift Java bindings before 0.25.0 allows remote, unauthenticated attackers to crash or exhaust resources on a service that deserializes attacker-controlled Thrift messages, because exceptional conditions on the message-handling path are not handled correctly and resource allocation is not bounded or throttled. Only deployments running affected Thrift Java server code on a network-reachable endpoint are at risk; impact is confined to availability (service crash / resource exhaustion) with no loss of confidentiality or integrity, and a specific precondition must hold - the crafted input must reach the vulnerable exception-handling or allocation path rather than any arbitrary request. There is no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 0.25.0.
Denial of service in PyJWT 2.9.0 through 2.13.0: a single malformed RSA JWK embedded in a JWK Set aborts construction of the entire set, causing authentication failures or request-level outages for applications that rely on that key set. The root cause is PyJWKSet's per-key error-skipping logic, which only catches PyJWTError and therefore misses the plain ValueError raised by RSAAlgorithm.from_jwk when an RSA key supplies d/e/n with an incorrect private exponent and omits the CRT parameters. The issue is remotely reachable without authentication or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only), publicly available exploit code exists (no confirmed active exploitation), EPSS is low at 0.35% (26th percentile), and the vendor-released patch is version 2.14.0.
Malformed service-registry records can blank out service discovery for Steeltoe-based cloud-native applications: EurekaDiscoveryClient versions 4.0.0 through 4.2.x deserialize the entire Eureka registry response as one atomic unit, so a single instance entry with an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp aborts the whole payload and leaves every connected client with an empty or stale instance list. The vendor rates this 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) while the independent assessment rates the vector with PR:L and scope changed, reflecting that a practical attacker must be a principal able to register or update an instance in the Eureka registry that victim clients consume; impact is availability-only, with no data exposure or code execution, and the effect self-heals once the bad registration is removed. No public exploit code has been identified at time of analysis and the issue is fixed in Steeltoe 4.3.0.
Consul service discovery in Steeltoe 4.0.0 through 4.2.x can be rendered persistently unusable by a single malformed service registration, because ConsulServiceInstance parses the registration's 'secure' metadata with a strict Boolean conversion that throws on any value other than 'true' or 'false'. A principal able to write to the Consul catalog - i.e. holding a valid ACL token with service-registration rights, or reaching a Consul deployment that runs without ACLs - can register a service whose 'secure' metadata is set to a value such as 'yes', '1' or an empty string; the resulting exception aborts construction of the instance list, and because GetAllInstancesAsync throws on the first bad entry, enumeration of every discovered service fails, taking the target (or the entire discovery surface) offline until the offending registration is removed. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (the advisory's vector differs only in reporting PR:N instead of PR:L), and while no public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied, the impact is low-complexity and requires no user interaction, so Consul catalog write access should be treated as a denial-of-service primitive.
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Drift-detection logic flaw in the @hulumi/drift npm package (versions < 1.4.0) causes the verdict classifier to conflate adapter failure with a clean result, producing cached false-negative 'None / none' verdicts for up to six hours and false-positive incident-severity 'Mixed / high' or 'ConsoleBreakGlass / high' verdicts based on probe liveness rather than CloudTrail evidence. Consumers running drift detection in CI or cron pipelines could silently miss real console-break-glass mutations or be paged on routine provider-version churn. No public exploit identified at time of analysis; the issue is a CWE-755 improper-exception-handling defect rather than a remote attack primitive.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in the zipdetails CLI tool bundled with Perl's IO::Compress versions 2.207 through 2.219 causes the script to abort with status 255 when parsing a ZIP archive containing an Info-ZIP Unix Extra Field (tag 0x7875) that declares an 8-byte UID or GID size. The bug is a typo in the source (calling unpackValueQ instead of unpackValue_Q), and no public exploit is identified at time of analysis; library callers of IO::Compress/IO::Uncompress are unaffected. EPSS is negligible (0.02%) and impact is limited to crashing the inspection tool, not the consuming application.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Denial of service in the Apache Thrift Java bindings before 0.25.0 allows remote, unauthenticated attackers to crash or exhaust resources on a service that deserializes attacker-controlled Thrift messages, because exceptional conditions on the message-handling path are not handled correctly and resource allocation is not bounded or throttled. Only deployments running affected Thrift Java server code on a network-reachable endpoint are at risk; impact is confined to availability (service crash / resource exhaustion) with no loss of confidentiality or integrity, and a specific precondition must hold - the crafted input must reach the vulnerable exception-handling or allocation path rather than any arbitrary request. There is no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 0.25.0.
Denial of service in PyJWT 2.9.0 through 2.13.0: a single malformed RSA JWK embedded in a JWK Set aborts construction of the entire set, causing authentication failures or request-level outages for applications that rely on that key set. The root cause is PyJWKSet's per-key error-skipping logic, which only catches PyJWTError and therefore misses the plain ValueError raised by RSAAlgorithm.from_jwk when an RSA key supplies d/e/n with an incorrect private exponent and omits the CRT parameters. The issue is remotely reachable without authentication or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only), publicly available exploit code exists (no confirmed active exploitation), EPSS is low at 0.35% (26th percentile), and the vendor-released patch is version 2.14.0.
Malformed service-registry records can blank out service discovery for Steeltoe-based cloud-native applications: EurekaDiscoveryClient versions 4.0.0 through 4.2.x deserialize the entire Eureka registry response as one atomic unit, so a single instance entry with an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp aborts the whole payload and leaves every connected client with an empty or stale instance list. The vendor rates this 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) while the independent assessment rates the vector with PR:L and scope changed, reflecting that a practical attacker must be a principal able to register or update an instance in the Eureka registry that victim clients consume; impact is availability-only, with no data exposure or code execution, and the effect self-heals once the bad registration is removed. No public exploit code has been identified at time of analysis and the issue is fixed in Steeltoe 4.3.0.
Consul service discovery in Steeltoe 4.0.0 through 4.2.x can be rendered persistently unusable by a single malformed service registration, because ConsulServiceInstance parses the registration's 'secure' metadata with a strict Boolean conversion that throws on any value other than 'true' or 'false'. A principal able to write to the Consul catalog - i.e. holding a valid ACL token with service-registration rights, or reaching a Consul deployment that runs without ACLs - can register a service whose 'secure' metadata is set to a value such as 'yes', '1' or an empty string; the resulting exception aborts construction of the instance list, and because GetAllInstancesAsync throws on the first bad entry, enumeration of every discovered service fails, taking the target (or the entire discovery surface) offline until the offending registration is removed. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (the advisory's vector differs only in reporting PR:N instead of PR:L), and while no public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied, the impact is low-complexity and requires no user interaction, so Consul catalog write access should be treated as a denial-of-service primitive.
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Drift-detection logic flaw in the @hulumi/drift npm package (versions < 1.4.0) causes the verdict classifier to conflate adapter failure with a clean result, producing cached false-negative 'None / none' verdicts for up to six hours and false-positive incident-severity 'Mixed / high' or 'ConsoleBreakGlass / high' verdicts based on probe liveness rather than CloudTrail evidence. Consumers running drift detection in CI or cron pipelines could silently miss real console-break-glass mutations or be paged on routine provider-version churn. No public exploit identified at time of analysis; the issue is a CWE-755 improper-exception-handling defect rather than a remote attack primitive.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in the zipdetails CLI tool bundled with Perl's IO::Compress versions 2.207 through 2.219 causes the script to abort with status 255 when parsing a ZIP archive containing an Info-ZIP Unix Extra Field (tag 0x7875) that declares an 8-byte UID or GID size. The bug is a typo in the source (calling unpackValueQ instead of unpackValue_Q), and no public exploit is identified at time of analysis; library callers of IO::Compress/IO::Uncompress are unaffected. EPSS is negligible (0.02%) and impact is limited to crashing the inspection tool, not the consuming application.