CVE Vulnerability Catalog

An out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch leads to a heap buffer overflow. An authenticated attacker can exploit it by sending crafted Codec2 audio packets within an established call.

An unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a crafted packet causing a stack buffer overflow and corrupting the transport, permanently disabling all SIP functionality until restart.

The PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The backend must be loaded and configured, and CELGenUserEvent must be called without validating input.

The chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix, which was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can crash Asterisk.

Microsoft Edge (Chromium-based) contains a type confusion vulnerability when accessing a resource using an incompatible type. An unauthenticated attacker can exploit it to execute code over a network.

Microsoft Edge (Chromium-based) contains a double free vulnerability. An unauthenticated attacker can exploit it to execute code over a network.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only ARI permissions may, under certain conditions, perform write operations via REST-over-WebSocket. The authorization bypass enables arbitrary module path loading and conditional remote code execution.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

pageant versions 0.2.0 through 0.2.5 trust a peer-controlled four-byte length prefix and buffer until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This is fixed in version 0.2.5.

In the russh Rust SSH library from 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable. Asynchronous write paths remain pending forever, allowing an authenticated client to strand server writes and a malicious server to strand client writes.

In russh prior to 0.65.0, the client Session::process_packet path accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector, causing progressive client memory exhaustion.

russh before 0.65.0 in russh::keys::agent::server::serve accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This is fixed in version 0.65.0.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.

In OpenTelemetry Python prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. When an untrusted carrier supplies numerous or oversized values, the service performs unnecessary CPU work and short-lived heap allocations, contributing to denial of service.

In dd-trace, the Datadog APM client for Node.js, from 2.0.0 until 5.131.1 and 6.20.1 the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. This causes excessive CPU consumption and can stall request processing, making the application unavailable.

In MLflow from 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of allowed modules rather than requiring an exact allowed module. An attacker can place a Python module under a writable allowed package and invoke it via /ajax-api/3.0/mlflow/scorer/invoke, leading to code execution. Version 3.17.0 fixes the issue.

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.