Vulnerability-Lookup

GHSA-HQ9H-682Q-JG37

Vulnerability from github – Published: 2026-03-10 21:32 – Updated: 2026-06-30 03:35

Details

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.

Severity

5.1 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-23868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-415",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-10T20:16:25Z",
    "severity": "MODERATE"
  },
  "details": "Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.",
  "id": "GHSA-hq9h-682q-jg37",
  "modified": "2026-06-30T03:35:51Z",
  "published": "2026-03-10T21:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23868"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2026-23868"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106/tree/gifalloc.c?diff=5146815377b7395944cb683a08c43eee3f631eb7"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23868.json"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446207"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23868"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9295"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9294"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9292"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9291"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9290"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8887"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8886"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8885"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8884"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8883"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8861"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8859"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:8858"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:25096"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:19725"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:19724"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:19367"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:19154"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:16174"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:16030"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:16009"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:16008"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J4JV-FP59-574F

Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-06-30 03:37

Details

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable.

fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well.

Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-53175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T09:16:34Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: fix use-after-free caused by the fqdir_pre_exit() flush\n\nOn netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and\nflushes every fragment queue that is not yet complete using\ninet_frag_queue_flush(). That helper frees all the skbs queued on the\nfragment queue but does not set INET_FRAG_COMPLETE, and leaves\nq-\u003efragments_tail and q-\u003elast_run_head pointing at the freed skbs.\nThe queue itself stays in the rhashtable.\n\nfqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups,\nbut it cannot stop a fragment that already obtained the queue through\ninet_frag_find() earlier and stalled just before taking the queue lock.\nOnce that fragment resumes after the flush and takes the queue lock,\nit passes the INET_FRAG_COMPLETE check and then dereferences the freed\nfragments_tail. inet_frag_queue_insert() reads FRAG_CB() and -\u003elen of\nthat pointer and, on the append path, writes -\u003enext_frag, causing a\nslab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly\nshare the same flush path and are affected as well.\n\nReset rb_fragments, fragments_tail and last_run_head in\ninet_frag_queue_flush() so a flushed queue no longer points at the\nfreed skbs. A fragment that resumes after the flush and takes the\nqueue lock then finds an empty queue and starts a new run instead of\ndereferencing the freed fragments_tail. ip_frag_reinit() already\nperformed this reset after its own flush, so drop the now duplicate\ncode there.",
  "id": "GHSA-j4jv-fp59-574f",
  "modified": "2026-06-30T03:37:13Z",
  "published": "2026-06-25T09:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53175"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53175"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492840"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53175.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J5J7-C96C-3P39

Vulnerability from github – Published: 2024-05-08 15:30 – Updated: 2024-05-08 15:30

Details

When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-28889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-08T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "\n\n\nWhen an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker\u0027s control can cause the Traffic Management Microkernel (TMM) to terminate.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-j5j7-c96c-3p39",
  "modified": "2024-05-08T15:30:42Z",
  "published": "2024-05-08T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28889"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000138912"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J72M-4PGW-W3QV

Vulnerability from github – Published: 2024-08-14 15:31 – Updated: 2024-08-19 18:32

Details

When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39792"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-672",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-14T15:15:26Z",
    "severity": "HIGH"
  },
  "details": "When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-j72m-4pgw-w3qv",
  "modified": "2024-08-19T18:32:05Z",
  "published": "2024-08-14T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39792"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000140108"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-JF88-7285-JCH4

Vulnerability from github – Published: 2025-11-18 21:32 – Updated: 2025-11-18 21:32

Details

A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.

Severity

4.9 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-61663"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T19:15:50Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in the GRUB2 bootloader\u0027s normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.",
  "id": "GHSA-jf88-7285-jch4",
  "modified": "2025-11-18T21:32:31Z",
  "published": "2025-11-18T21:32:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61663"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-61663"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414684"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-JG8P-VFVP-34JW

Vulnerability from github – Published: 2026-06-16 15:33 – Updated: 2026-06-30 03:37

Details

Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-12326"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-16T13:16:33Z",
    "severity": "HIGH"
  },
  "details": "Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.",
  "id": "GHSA-jg8p-vfvp-34jw",
  "modified": "2026-06-30T03:37:06Z",
  "published": "2026-06-16T15:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12326"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-12326"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767455%2C2004308%2C2024445%2C2028182%2C2029765%2C2029883%2C2030110%2C2030149%2C2030366%2C2030374%2C2030564%2C2031120%2C2033411%2C2038695%2C2042465%2C2042781%2C2042907"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021955%2C2025960%2C2029066%2C2029403%2C2029435%2C2029803%2C2030570%2C2030573%2C2032264%2C2033234%2C2034816%2C2035907%2C2035963%2C2036895%2C2036898%2C2036907%2C2036909%2C2036928%2C2036931%2C2036932%2C2036934%2C2039238%2C2039463"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2039050%2C2042718%2C2042760%2C2044831%2C2045307%2C2045398%2C2045516%2C2045572%2C2041741%2C2044433"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489222"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12326.json"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-57"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-60"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M237-4JXG-W5JH

Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-08-12 12:32

Details

In the Linux kernel, the following vulnerability has been resolved:

ipc: limit next_id allocation to the valid ID range

The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound.

If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object.

The bug is in ipc_idr_alloc() in the checkpoint/restore path.

ids->next_id is passed to:

idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)
The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range.
The new object id is still encoded with the narrower SysV IPC index width:

new->id = (new->seq << ipcmni_seq_shift()) + idx
Later removal goes through ipc_rmid(), which uses:

ipcid_to_idx(ipcp->id)

That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index.

For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer.
A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory.

Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-52923"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401",
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T08:16:22Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id.  ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni.  The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n       idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n   Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n   ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n   width:\n\n       new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n       ipcid_to_idx(ipcp-\u003eid)\n\n   That truncates the real IDR index. An object actually stored at a\n   high index can then be removed as if it lived at a low in-range\n   index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n   the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n   and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.",
  "id": "GHSA-m237-4jxg-w5jh",
  "modified": "2026-08-12T12:32:54Z",
  "published": "2026-06-24T09:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52923"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492094"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-52923"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53330"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:52764"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:52649"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:51604"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:51603"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:49857"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:49851"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:49212"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:49031"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:48386"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:47248"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M4M5-7XC2-XC7G

Vulnerability from github – Published: 2026-06-16 03:30 – Updated: 2026-08-25 12:31

Details

A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Severity

6.6 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-42014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-16T02:16:19Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.",
  "id": "GHSA-m4m5-7xc2-xc7g",
  "modified": "2026-08-25T12:31:20Z",
  "published": "2026-06-16T03:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42014"
    },
    {
      "type": "WEB",
      "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-9"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gnutls/gnutls/-/issues/1766"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-42014"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:58981"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:43575"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:41921"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:33125"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:32962"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30850"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30849"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30004"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:29197"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26409"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26319"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:20613"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:20612"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:20611"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:13274"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M8WH-XH8F-8MXC

Vulnerability from github – Published: 2026-08-20 00:35 – Updated: 2026-08-20 00:35

Details

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-76890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-825"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T23:16:20Z",
    "severity": "LOW"
  },
  "details": "Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service",
  "id": "GHSA-m8wh-xh8f-8mxc",
  "modified": "2026-08-20T00:35:10Z",
  "published": "2026-08-20T00:35:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76890"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21399"
    },
    {
      "type": "WEB",
      "url": "https://www.wireshark.org/security/wnpa-sec-2026-65.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MC22-5Q92-8V85

Vulnerability from github – Published: 2021-09-20 19:52 – Updated: 2021-09-17 17:50

Summary

Memory Safety Issue when using patch or merge on state and assign the result back to state

Details

Impact

This vulnerability is a memory safety Issue when using patch or merge on state and assign the result back to state. In this case affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the state, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct.

Details

If affects the following two tremor-script language constructs:

A Merge where we assign the result back to the target expression and the expression to be merged needs to reference the event:

let state = merge state of event end;

A Patch where we assign the result back to the target expression and the patch operations used need to reference the event:

let state = patch state of insert event.key => event.value end;

For constructs like this (it does not matter what it references in the expression to be merged or the patch operations) an optimization was applied to manipulate the target value in-place, instead of cloning it.

Our Value struct, which underpins all event data in tremor-script, is representing strings as borrowed beef::Cow<'lifetime, str>, that reference the raw data Vec<u8> the event is based upon. We keep this raw byte-array next to the Value structure inside our Event as a self-referential struct, so we make sure that the structured Value and its references are valid across its whole lifetime.

The optimization was considered safe as long as it was only possible to merge or patch event data or static data. When state was introduced to tremor-script (in version 0.7.3) a new possibility to keep Value data around for longer than the lifetime of an event emerged. If event data is merged or patched into state without cloning it first, it can still reference keys or values from the previous event, which will now be invalid. This allows access to those already freed regions of memory and to get their content out over the wire.

Patches

The issue has been patched in https://crates.io/crates/tremor-script/0.11.6 and https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6 via commit 1a2efcd by removing the optimization and always clone the target expression of a Merge or [Patch](https://www.tremor.rs/docs/tremor-script/index#patch.

Workarounds

If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to state:

let tmp = merge state of event end;
let state = tmp

References

The actual fix is applied in this PR: https://github.com/tremor-rs/tremor-runtime/pull/1217

For more information

If you have any questions or comments about this advisory: * Open an issue on our repository tremor-rs/tremor-runtime * Please join our discord https://chat.tremor.rs and reach out to the team.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tremor-script"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.3"
            },
            {
              "fixed": "0.11.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39228"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416",
      "CWE-825"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-17T17:50:18Z",
    "nvd_published_at": "2021-09-17T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "\n### Impact\n\nThis vulnerability is a memory safety Issue when using [`patch`](https://www.tremor.rs/docs/tremor-script/index#patch) or [`merge`](https://www.tremor.rs/docs/tremor-script/index#merge) on `state` and assign the result back to `state`.\nIn this case affected versions of Tremor and the [tremor-script crate](https://crates.io/crates/tremor-script) maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct.\n\n#### Details\n\nIf affects the following two tremor-script language constructs:\n\n* A [Merge](https://www.tremor.rs/docs/tremor-script/index#merge) where we assign the result back to the target expression\n  and the expression to be merged needs to reference the `event`:\n\n```\nlet state = merge state of event end;\n```\n\n* A [Patch](https://www.tremor.rs/docs/tremor-script/index#patch) where we assign the result back to the target expression\n  and the patch operations used need to reference the `event`:\n\n```\nlet state = patch state of insert event.key =\u003e event.value end;\n```\n\nFor constructs like this (it does not matter what it references in the expression to be merged or the patch operations) an optimization\nwas applied to manipulate the target value in-place, instead of cloning it.\n\nOur `Value` struct, which underpins all event data in `tremor-script`, is representing strings as borrowed `beef::Cow\u003c\u0027lifetime, str\u003e`, \nthat reference the raw data `Vec\u003cu8\u003e` the event is based upon. We keep this raw byte-array next to the `Value` structure inside our `Event` as a self-referential struct,\nso we make sure that the structured `Value` and its references are valid across its whole lifetime.\n\nThe optimization was considered safe as long as it was only possible to merge or patch `event` data or static data.\nWhen `state` was introduced to `tremor-script` (in version 0.7.3) a new possibility to keep `Value` data around for longer than the lifetime of an event emerged.\nIf `event` data is merged or patched into `state` without cloning it first, it can still reference keys or values from\nthe previous event, which will now be invalid. This allows access to those already freed regions of memory and to get their content out over the wire.\n\n### Patches\n\nThe issue has been patched in https://crates.io/crates/tremor-script/0.11.6 and https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6 via commit [1a2efcd](https://github.com/tremor-rs/tremor-runtime/commit/1a2efcdbe68e5e7fd0a05836ac32d2cde78a0b2e) by removing the optimization\nand always clone the target expression of a [Merge](https://www.tremor.rs/docs/tremor-script/index#merge) or [Patch](https://www.tremor.rs/docs/tremor-script/index#patch.\n\n### Workarounds\n\nIf an upgrade is not possible, a possible workaround is to avoid the optimization\nby introducing a temporary variable and not immediately reassigning to `state`:\n\n```\nlet tmp = merge state of event end;\nlet state = tmp\n```\n\n### References\n\nThe actual fix is applied in this PR: https://github.com/tremor-rs/tremor-runtime/pull/1217\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue on our repository [tremor-rs/tremor-runtime](https://github.com/tremor-rs/tremor-runtime)\n* Please join our discord https://chat.tremor.rs and reach out to the team.\n\n",
  "id": "GHSA-mc22-5q92-8v85",
  "modified": "2021-09-17T17:50:18Z",
  "published": "2021-09-20T19:52:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tremor-rs/tremor-runtime/security/advisories/GHSA-mc22-5q92-8v85"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39228"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tremor-rs/tremor-runtime/pull/1217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tremor-rs/tremor-runtime/commit/1a2efcdbe68e5e7fd0a05836ac32d2cde78a0b2e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tremor-rs/tremor-runtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Memory Safety Issue when using patch or merge on state and assign the result back to state"
}

CWE-825

Expired Pointer Dereference

GHSA-HQ9H-682Q-JG37

GHSA-J4JV-FP59-574F

GHSA-J5J7-C96C-3P39

GHSA-J72M-4PGW-W3QV

GHSA-JF88-7285-JCH4

GHSA-JG8P-VFVP-34JW

GHSA-M237-4JXG-W5JH

GHSA-M4M5-7XC2-XC7G

GHSA-M8WH-XH8F-8MXC

GHSA-MC22-5Q92-8V85

Impact

Details

Patches

Workarounds

References

For more information

Mitigation

Mitigation