Codechecker
Monthly
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user through specially crafted URLs. All versions through 6.27.3 are affected, exposing static analysis infrastructure to complete compromise. CVSS 9.3 (Critical) with SSVC framework confirming total technical impact and automated exploitation potential. Proof-of-concept code exists (CVSS vector E:P), though CISA KEV does not currently list active exploitation. EPSS data unavailable but attack prerequisites are minimal (AV:N/AC:L/PR:N), making this a high-priority remediation target for organizations using CodeChecker in their development pipelines.
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users holding analysis-run storage permissions to trigger denial of service via a decompression bomb. The processing path accepts Base64-encoded zlib payloads and fully materializes the decompressed output in memory before any disk write, with no maximum decompressed size enforced - a small compressed payload can expand to gigabytes. A proof-of-concept exists (CVSS 4.0 supplemental metric E:P) and the attack is automatable (AU:Y), meaning a compromised or malicious account with store permissions can repeatedly crash the service or exhaust host resources.
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. No active exploitation is confirmed in the CISA KEV catalog; however, the CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exists, and the overall base score of 1.2 reflects high required privileges and low individual impact metrics.
Stack-based buffer overflow in CodeChecker through 6.26.1 can be triggered by the local `CodeChecker log` command when it processes a crafted overlong compilation path, allowing a low-privileged local attacker to corrupt memory and potentially execute code or crash the process. A publicly available exploit code exists, but EPSS is only 0.19% (8th percentile), and this is a moderate-priority, high-CVSS-but-low-real-world-urgency issue when judged across all signals. The vulnerability requires local invocation of `CodeChecker log` with attacker-influenced input, so shared CI runners or automated build pipelines ingesting untrusted paths are the realistic risk scenarios; fixed in CodeChecker 6.26.2.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user through specially crafted URLs. All versions through 6.27.3 are affected, exposing static analysis infrastructure to complete compromise. CVSS 9.3 (Critical) with SSVC framework confirming total technical impact and automated exploitation potential. Proof-of-concept code exists (CVSS vector E:P), though CISA KEV does not currently list active exploitation. EPSS data unavailable but attack prerequisites are minimal (AV:N/AC:L/PR:N), making this a high-priority remediation target for organizations using CodeChecker in their development pipelines.
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users holding analysis-run storage permissions to trigger denial of service via a decompression bomb. The processing path accepts Base64-encoded zlib payloads and fully materializes the decompressed output in memory before any disk write, with no maximum decompressed size enforced - a small compressed payload can expand to gigabytes. A proof-of-concept exists (CVSS 4.0 supplemental metric E:P) and the attack is automatable (AU:Y), meaning a compromised or malicious account with store permissions can repeatedly crash the service or exhaust host resources.
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. No active exploitation is confirmed in the CISA KEV catalog; however, the CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exists, and the overall base score of 1.2 reflects high required privileges and low individual impact metrics.
Stack-based buffer overflow in CodeChecker through 6.26.1 can be triggered by the local `CodeChecker log` command when it processes a crafted overlong compilation path, allowing a low-privileged local attacker to corrupt memory and potentially execute code or crash the process. A publicly available exploit code exists, but EPSS is only 0.19% (8th percentile), and this is a moderate-priority, high-CVSS-but-low-real-world-urgency issue when judged across all signals. The vulnerability requires local invocation of `CodeChecker log` with attacker-influenced input, so shared CI runners or automated build pipelines ingesting untrusted paths are the realistic risk scenarios; fixed in CodeChecker 6.26.2.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.