CVE Vulnerability Catalog

Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate, saturating a CPU core and stalling every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

In Eclipse ThreadX NetX Duo up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS. This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.

Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write files to arbitrary locations writable by the Appium process, potentially leading to code execution. This issue is fixed in version 7.2.6.

When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and contents of the cookie come from the peer, and the write occurs before certificate authentication completes, so a malicious or compromised server can overwrite memory past the TLS packet buffer without presenting a certificate. Only the client path is affected.

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection. This issue affects Salevo: from n/a through 1.3.0.

In Eclipse Vert.x versions [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context cache whose key does not fully reflect the SSL semantics of the desired properties. A client can request an SSL context and receive one with weaker properties, for example a context ignoring hostname validation instead of one with hostname validation. The impacted component is io.vertx:vertx-core.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.

A stack-based buffer overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a configured J-Web virtual domain.

A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

A stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to crash rpd or execute arbitrary code via a malformed LDP Label Mapping message.

A stack-based buffer overflow in authd of Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet when SNMP and AAA are enabled.

An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer that has not negotiated four-octet-AS capability to send a specifically malformed BGP update and cause a denial of service (DoS).

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

An incorrect calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.