CVE Vulnerability Catalog

Nimiq (Rust implementation) prior to version 1.4.0 has a bug in LightBlockchain::rebranch() – when switching to a chain with a macro block, it does not update macro_head, election_head, or current_validators. This causes incorrect verification of subsequent blocks and stalls the light client's chain progression.

In Nimiq before version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes it to return true without cryptographic verification when the hop list is empty. An attacker can forge a MacroBlock header for a specific epoch position and have it accepted as proven.

FlashMQ before version 1.26.2 allows authorized clients to exceed the permitted over-commit of their write buffer, triggering an internal safe-guard exception. This exception is in a path that cannot be caught, causing a server abort.

Nimiq before version 1.4.0 has a vulnerability in DHT GET query handling in the network-libp2p component. When a peer returns a found record and DHT verification fails, handle_dht_get returns without completing the oneshot and without cleaning up query state, causing Network::dht_get to hang indefinitely.

Spring Data REST's Querydsl integration accepts arbitrary property paths as filter keys and ignores Jackson customizations before handing them to Querydsl. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Vulnerability in Spring Data REST where the full exception cause chain is serialized into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Spring for Apache Kafka versions 4.0.0-4.0.5, 3.3.0-3.3.15, 3.2.0-3.2.13, 2.9.0-2.9.13, and 2.8.0-2.8.11 allow a producer to grow the consumer's heap without bound by sending records with unique spring.kafka.serialization.selector header values, leading to GC thrash and OutOfMemoryError.

Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.

A SpEL Injection vulnerability in Spring Data KeyValue occurs when unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. An attacker can remotely execute arbitrary code.

In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.

A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.

Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.

Spring Data Relational does not properly escape binding values for externally-controlled input when using StringMatcher (STARTING, ENDING, CONTAINING) in Query By Example (QBE). An attacker can use wildcard characters for data inference. Affects many versions of Spring Data Relational/JDBC/R2DBC.

Spring Data MongoDB improperly validates regex parameters in @Query annotated repository methods. An attacker can supply a crafted string to bypass intended regular expression quoting.

Vulnerability in Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request with an invalid request_uri and an arbitrary, unvalidated redirect_uri, leading to an Open Redirect vulnerability. Affects Spring Security 7.0.0-7.0.5 and Spring Authorization Server 1.5.0-1.5.7.

An XXE vulnerability in Spring REST Docs when using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API over HTTP. An attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE attack when documentation-generating tests are next executed.

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

An authorized user can trigger a server crash by running a query with a 2dsphere index on a field storing a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. The guard does not inspect GeometryCollection members, leading to a null-pointer dereference.