CVE Vulnerability Catalog

The MQTT 5 parser in RabbitMQ accepts the Request-Problem-Information property on PUBLISH packets even though it is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a matching subscriber, leading to a function_clause exception that closes the victim's MQTT or Web MQTT connection. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

The MCP Python SDK (mcp on PyPI) from 1.8.0 until 1.30.0 and 2.2.0 does not reliably discard session entries in stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. A client that can reach the endpoint can send ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected.

Improper certificate validation in the ssl application in Erlang/OTP allows a client holding a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server serving multiple SNI names from one listen socket keeps one shared session cache and does not bind a cached session to the SNI name or client trust policy that established it. This affects OTP from 18.0 before 27.3.4.19, 28.5.0.8, and 29.1.2.

An out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker sending a specific set of BGP communities to cause a denial of service (DoS) as rpd crashes when the graceful-shutdown sender community is added during advertisement.

An incomplete list of disallowed inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a denial of service (DoS). When a specific, valid, optional, non-transitive BGP update is received over an established BGP session in a BGP traffic engineering scenario, RPD crashes and automatically restarts, leading to traffic impact until routing reconverges.

A NULL pointer dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete denial of service (DoS). When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash.

An improper restriction of communication channel to intended endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact to the device. Due to wrong initialization, a process that should only communicate internally can be reached over the network via an open port, leading to inadvertent exposure and increased CPU cycles spent processing ingress packets.

An improper resource locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a denial of service (DoS). When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, leading to a complete service outage. This applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).

An improper handling of missing special element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a denial of service (DoS). This occurs when 'ssl-proxy' is configured on SRX platforms and a specifically malformed TLS message is received during a TLS session-resumption attempt, resulting in an invalid pointer access and PFE crash, causing temporary loss of traffic forwarding until the PFE automatically recovers.

An improper resource locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows an unauthenticated, logically adjacent attacker to cause a denial of service (DoS). If a SyncE or PTP upstream node sends a malformed message to an MX device equipped with SCBE3, a false 19.44MHz alarm is generated on the master RE, leading to persistent RE switchovers and a clksyncd process crash.

A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, leading to a complete service outage until the service automatically recovers. This is a race condition outside the attacker's direct control.

An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.

A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.

An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP.

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion via EVPN-VXLAN active-active multihoming route processing.