CVE Vulnerability Catalog

In Twisted prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

In Twisted before 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches parseNestedParens with a negative literal size in an authenticated SEARCH command after the client selects a mailbox. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating, freezing the single-threaded reactor.

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it.

In HTTP::Headers::ActionPack versions before 0.10 for Perl, _language_match interpolates each Accept-Language range into the pattern /^$range\-/i without escaping it, so regular expression syntax in the header reaches the regex engine. A crafted range can cause catastrophic backtracking and CPU exhaustion, or make choose_language die.

A buffer overflow vulnerability in the Bluetooth HCI USB transport class (subsys/usb/device_next/class/bt_hci.c) of the new USB device stack. bt_hci_tx_sync_in() copies controller-to-host HCI packets into a fixed-size buffer of USBD_MAX_BULK_MPS bytes (64 bytes) without a length check, while packets can be much larger (e.g., the Read Supported Commands event is 70 bytes). In production builds (CONFIG_ASSERT=n) this silently corrupts memory, potentially leading to remote code execution or denial of service.

In the DNS stub resolver (subsys/net/lib/dns/resolve.c), the UDP socket is bound only once at resolver context initialisation, so the source port stays constant for the lifetime of the context while only the 16-bit transaction identifier varies. This violates RFC 5452 section 9.2 and lets an attacker with UDP reachability guess just the identifier and inject a forged reply. The fix draws a fresh source port before each query (CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT, default y).

The DHCPv4 client in Zephyr RTOS (subsys/net/lib/dhcpv4/dhcpv4.c) maintained its transaction identifier (xid) as a counter rather than a per-transaction random value. It was seeded once with sys_rand32_get() and incremented by one, and RENEWING and REBINDING exchanges reused the unchanged or predictable identifier. Since the xid is the only unpredictable reply-validation token, an attacker can learn or predict it and send a forged DHCP reply that changes the default gateway and DNS resolvers.

The arm64 MMU backend's invalidate_tlb_page() only invalidated TLB entries for ASID 0, while memory domains use ASIDs starting at 1. As a result, after a page was evicted via demand paging, a user thread retained a valid translation to the freed frame, allowing read and write access to data later placed there.

A vulnerability in the ADXL345 sensor driver (drivers/sensor/adi/adxl345/adxl345_stream.c) in Zephyr RTOS involves a buffer overflow during RTIO FIFO streaming. The driver clamps the reported data length to available buffer space but still queues one bus read per hardware FIFO entry, causing writes up to 186 bytes past the allocation when the buffer is smaller than a full batch. A companion defect leaves fifo_total_bytes un-reset at batch start, potentially carrying a stale write offset into the next batch.

A vulnerability in the WireGuard service in Zephyr RTOS (subsys/net/lib/wireguard/wg.c) allows the peer endpoint to be updated from an unauthenticated transport-data message. In handle_transport_data(), when the 32-bit receiver index matches no session, the code copies the datagram's source address into peer->endpoint even though no key exists to verify the message. A single spoofed UDP datagram sent to port 51820 can persistently redirect tunnel traffic to an attacker-chosen address.

Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with the default "J01NME", a publicly known example Joining Device Credential from OpenThread and Thread documentation. Firmware built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd shipped with this public credential compiled in, with no build-time or run-time warning. An attacker within 802.15.4 radio range of an uncommissioned device can complete the DTLS-PSK handshake and supply an attacker-controlled operational dataset.

A weakness was identified in Tenda F6 version 12.02.01.73 affecting an unknown function of the web management interface. Manipulating the ecos_pw argument can lead to cleartext transmission of sensitive information. The attack may be launched remotely, is characterized by high complexity, and a public exploit is available.

A security flaw was discovered in Tenda F6 version 12.02.01.73 affecting an unknown function of the web management interface. Manipulation leads to cross-site request forgery, and the attack can be initiated remotely. A public exploit has been released and may be used in attacks.

In virtualenv from 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.

In pypdf prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

In pypdf prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

pypdf before version 6.21.2 is vulnerable to an attack where a crafted PDF repeatedly references the same nonexistent indirect object. This triggers repeated full-file recovery loads and long runtimes when accessing parts such as pages. The issue is fixed in version 6.21.2.

A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.