CVE Vulnerability Catalog

The STM32WBA IEEE 802.15.4 driver computed the packet length as the frame length minus the FCS length without first verifying that the reported length could hold an FCS. A reported length of 0 or 1 caused a uint8_t underflow to 254 or 255, and the only bound (__ASSERT_NO_MSG) was compiled out in the default production configuration. As a result, the driver read roughly 128 bytes past the radio receive buffer and copied that adjacent memory into a network packet submitted to the networking stack.

The CC1200 sub-GHz IEEE 802.15.4 driver reads the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity(), which only enforces a lower bound (pkt_len < 3) and never bounds large values. Because the radio is configured for variable packet length with PKT_LEN = 0xFF, the over-the-air length byte (0-255) reaches net_pkt_rx_alloc_with_buffer() and the SPI burst read unclamped. An unauthenticated attacker within radio range can transmit a frame with a length byte above the IEEE 802.15.4 maximum of 127, causing a write past the end of a network buffer fragment.

The NXP KW41Z IEEE 802.15.4 driver (kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c) computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t. Because the frame length comes from the unauthenticated RX_FRAME_LENGTH field of the ZLL IRQSTS register and only zero was rejected, a reported length of one underflowed to pkt_len == 255. This caused 255 bytes to be written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory and reading past the PKT_BUFFER_RX register array.

The MQTT 5 parser in RabbitMQ accepts the Request-Problem-Information property on PUBLISH packets even though it is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a matching subscriber, leading to a function_clause exception that closes the victim's MQTT or Web MQTT connection. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

The MCP Python SDK (mcp on PyPI) from 1.8.0 until 1.30.0 and 2.2.0 does not reliably discard session entries in stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. A client that can reach the endpoint can send ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected.

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.

A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.

A stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.

A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

A vulnerability in ethernet_recv() in subsys/net/l2/ethernet/ethernet.c in the Zephyr network stack. When the ethertype is 0x8100 and VLAN is enabled on the interface, the received frame buffer is reinterpreted as an 18-byte net_eth_vlan_hdr without re-checking the length, causing an out-of-bounds read and raising hdr_len to 18. A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers the issue.

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.

A missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

In the mtrudel bandit library, an unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by trickling small WINDOW_UPDATE frames. Each partial progress resets deadlines, so the blocked stream process, its Plug state and held resources stay alive as long as the attacker keeps dripping, exhausting server processes and memory. This issue affects bandit from 1.4.0 before 1.13.0.

Improper certificate validation in the ssl application in Erlang/OTP allows a client holding a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server serving multiple SNI names from one listen socket keeps one shared session cache and does not bind a cached session to the SNI name or client trust policy that established it. This affects OTP from 18.0 before 27.3.4.19, 28.5.0.8, and 29.1.2.

A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS. A malicious or compromised SDN-controller can cause a complete outage of the OVSDB control plane and possibly remote code execution.

An out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker sending a specific set of BGP communities to cause a denial of service (DoS) as rpd crashes when the graceful-shutdown sender community is added during advertisement.

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. A remote network attacker can cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms. A configured EVPN signaling peer can cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update, resulting in a denial of service affecting routing adjacencies.