CVE Vulnerability Catalog

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with multiple malformed cross-reference streams, causing long runtimes for recovering broken cross-reference table entries. This leads to excessive CPU usage and processing delays.

The Horde_Vfs_Smb driver in Horde Virtual File System (VFS) API before version 3.0.1 contains an OS command injection vulnerability. The _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows a denial of service attack via CPU exhaustion. A Markdown document containing many repeated or distinct reference-link definitions causes quadratic complexity in src/mistune/block_parser.py and the ref_links dictionary handling.

Mistune is a Python Markdown parser. Prior to version 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 causes quadratic computational complexity when processing sequences of closed tilde, equals-sign, or caret markers in strikethrough, mark, and insert plugins. An attacker can exploit this to cause CPU exhaustion (denial of service).

Vulnerability in @opentelemetry/propagator-jaeger for JavaScript prior to version 2.9.0. Unsafe decoding of HTTP headers uber-trace-id and uberctx-* using decodeURIComponent() allows an unauthenticated remote attacker to send a malformed percent-encoded value, causing an uncaught URIError and terminating a Node.js process using JaegerPropagator as the active propagator.

The linkify-it library before version 5.0.2 contains a ReDoS (Regular Expression Denial of Service) vulnerability. The mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text.

In Immutable.js versions prior to 4.3.9 and 5.1.8, a vulnerability exists in List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn. Mishandling of an index or size in the range 2**30 to 2**31 in setListBounds in src/List.js can cause an uncatchable infinite loop, unbounded memory allocation, or silent wrapping of large values.

Astro version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation, potentially allowing bypass of access controls to protected routes.

A vulnerability in OpenClaw before version 2026.5.28 allows workspace dotenv files to override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when it points outside the root.

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets without cumulative length validation.

Vulnerability in U-Boot up to version 2026.04-rc3 in the tcp_rx_state_machine() function in net/tcp.c. Sending a crafted TCP SYN+ACK packet with a manipulated data offset field causes an integer underflow, leading to bootloader crash and potential memory corruption.

OpenVPN Access Server versions 2.7.2 through 3.1.0 accept bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy.

In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.

The node-tar library before version 7.5.18 accepts a tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.

The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.

js-yaml prior to versions 3.15.1, 4.3.1, and 5.2.1 contains a vulnerability in YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default; v5 doesn't use !!omap by default.

A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.

A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.