Codechecker
Monthly
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users holding analysis-run storage permissions to trigger denial of service via a decompression bomb. The processing path accepts Base64-encoded zlib payloads and fully materializes the decompressed output in memory before any disk write, with no maximum decompressed size enforced - a small compressed payload can expand to gigabytes. A proof-of-concept exists (CVSS 4.0 supplemental metric E:P) and the attack is automatable (AU:Y), meaning a compromised or malicious account with store permissions can repeatedly crash the service or exhaust host resources.
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. No active exploitation is confirmed in the CISA KEV catalog; however, the CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exists, and the overall base score of 1.2 reflects high required privileges and low individual impact metrics.
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user through specially crafted URLs. All versions through 6.27.3 are affected, exposing static analysis infrastructure to complete compromise. CVSS 9.3 (Critical) with SSVC framework confirming total technical impact and automated exploitation potential. Proof-of-concept code exists (CVSS vector E:P), though CISA KEV does not currently list active exploitation. EPSS data unavailable but attack prerequisites are minimal (AV:N/AC:L/PR:N), making this a high-priority remediation target for organizations using CodeChecker in their development pipelines.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users holding analysis-run storage permissions to trigger denial of service via a decompression bomb. The processing path accepts Base64-encoded zlib payloads and fully materializes the decompressed output in memory before any disk write, with no maximum decompressed size enforced - a small compressed payload can expand to gigabytes. A proof-of-concept exists (CVSS 4.0 supplemental metric E:P) and the attack is automatable (AU:Y), meaning a compromised or malicious account with store permissions can repeatedly crash the service or exhaust host resources.
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. No active exploitation is confirmed in the CISA KEV catalog; however, the CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exists, and the overall base score of 1.2 reflects high required privileges and low individual impact metrics.
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user through specially crafted URLs. All versions through 6.27.3 are affected, exposing static analysis infrastructure to complete compromise. CVSS 9.3 (Critical) with SSVC framework confirming total technical impact and automated exploitation potential. Proof-of-concept code exists (CVSS vector E:P), though CISA KEV does not currently list active exploitation. EPSS data unavailable but attack prerequisites are minimal (AV:N/AC:L/PR:N), making this a high-priority remediation target for organizations using CodeChecker in their development pipelines.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.