Airsane
Monthly
Remote unauthenticated denial-of-service in AirSane scanner server (versions prior to 0.4.12) allows an attacker to crash the daemon by sending an HTTP POST request with an arbitrarily large Content-Length value, triggering memory exhaustion and a std::bad_alloc exception. The root cause is in httpserver.cpp, where the Content-Length header value is passed directly to std::string::resize() with no upper-bound validation. A secondary variant using non-numeric Content-Length values produces undefined behavior via NaN-to-integer conversion. No public exploit or active exploitation has been identified at time of analysis.
Remote unauthenticated denial-of-service in AirSane scanner server (versions prior to 0.4.12) allows an attacker to crash the daemon by sending an HTTP POST request with an arbitrarily large Content-Length value, triggering memory exhaustion and a std::bad_alloc exception. The root cause is in httpserver.cpp, where the Content-Length header value is passed directly to std::string::resize() with no upper-bound validation. A secondary variant using non-numeric Content-Length values produces undefined behavior via NaN-to-integer conversion. No public exploit or active exploitation has been identified at time of analysis.