CVE Vulnerability Catalog

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) allows remote attackers to make the server allocate a large amount of memory by sending a crafted mcpack request with a huge array item count. The parser trusts the item count from the header without validating it against the actual payload size, potentially preallocating about 16GB of virtual memory.

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint.

An out-of-bounds read vulnerability exists in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned (e.g., ARM64). Input bytes with the high bit set (0x80–0xFF) are not normalized to the signed-char range, causing lookup-table indices in URL parsing and case-insensitive header lookup to exceed table bounds. This allows remote attackers to crash the process and cause denial of service via crafted input.

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service.

A missing authentication for critical function vulnerability exists in Apache IoTDB versions from 2.0.0 before 2.0.11. The flaw may allow unauthorized access to important system functionality.

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) but without WRITE_DATA or DELETE_DATA permissions can send crafted PipeData messages to execute operations as root, bypassing IoTDB's permission model.

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation before the parser rejects the incomplete payload.

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit.

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded recursively, potentially exhausting the thread stack.

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are publicly exposed, the first builtin request may mark the connection as authenticated for later requests.

A vulnerability was identified in Insurance-Management-System in the `mysqli_query` function of `/Admin/View/editPlan.php`. Manipulation of the `Plan_no/Name` argument leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.

Acronis Cyber Infrastructure (ACI) before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 has improper authorization checks, leading to sensitive information disclosure and manipulation.

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service in versions from 2.0.0 before 2.0.11. It may allow an attacker to gain access without valid credentials.

Uncontrolled Resource Consumption vulnerability in the Apache IoTDB JDBC driver. This issue affects versions from 1.3.3 before 2.0.11.