268 matches found
CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...
libtasn1 安全漏洞
libtasn1 is a small ASN.1 library open-sourced by gnutls. A security vulnerability exists in libtasn1 version v4.20.0, which stems from the asn1expendoctetstring function not validating the input data size, which could lead to a stack-based buffer overflow...
PoC-Analyzer
PoC Analyzer Proof-of-Concept Malicious Intent Detector !P...
Denial Of Service (DoS)
node-forge is vulnerable to Denial of Service DoS. The vulnerability is due to deep, attacker-crafted ASN.1 structures causing unbounded recursive parsing, allowing remote unauthenticated attackers to exhaust the stack and crash the application when processing untrusted DER input...
Interpretation-Conflict
node-forge is vulnerable to an Interpretation-Conflict. The vulnerability is due to crafted ASN.1 structures causing schema desynchronization, where inconsistent parsing can bypass downstream cryptographic checks and security decisions...
The vulnerability of the asn1.validate() function in the Forge/lib/asn1.js set of cryptographic tools and tools for developing web applications allows a perpetrator to circumvent security restrictions.
The vulnerability of the asn1.validate function in the Forge/lib/asn1.js set of cryptographic tools and tools for developing web applications is related to the occurrence of interpretation conflicts when processing data based on the ASN.1 standard. Exploiting this vulnerability could allow an...
node-forge ASN.1 Unbounded Recursion
...
UBUNTU-CVE-2025-66030
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be...
CVE-2025-66031 node-forge ASN.1 Unbounded Recursion
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This...
GHSA-5GFM-WPXJ-WJGQ node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
Summary CVE-2025-12816 has been reserved by CERT/CC Description An Interpretation Conflict CWE-436 vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may...
DEBIAN-CVE-2025-12816
An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...
UBUNTU-CVE-2025-12816
An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...
Interpretation Conflict
Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Interpretation Conflict via the asn1.validate function. An attacker can cause schema validation to become desynchronized, resulting in semantic divergence that may allow bypassing...
PT-2025-48075
Name of the Vulnerable Software and Affected Versions node-forge versions 1.3.1 and earlier Description An interpretation-conflict issue exists in node-forge. Unauthenticated attackers can create specific ASN.1 structures that disrupt schema validations. This can lead to a difference in how data ...
Forge JavaScript library impacted by a vulnerability in signature verification.
Overview The Forge JavaScript library provides TLS-related cryptographic utilities. A vulnerability that allows signature verification to be bypassed through crafted manipulation of ASN.1 structures, particularly in fields such as Message Authentication Code MAC data, was identified. Users of the...
The vulnerability of the Go programming language’s encoding/ASN1 component, which allows a hacker to trigger a service failure.
The vulnerability of the Go programming language’s encoding/ASN1 component is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
The vulnerability of the SAP CommonCryptoLib library, related to the execution of operations outside the buffer in memory, allows a hacker to trigger a service failure.
The vulnerability of the SAP CommonCryptoLib library is related to the execution of operations outside the buffer in memory when processing ASN.1 data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...
CVE-2025-42940
CVE-2025-42940 affects SAP CommonCryptoLib. The issue is boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network, leading to memory corruption and an application crash. Impact is high on availability, with no confidentiality or integrity impact stated. Connect...
PT-2025-46240
Name of the Vulnerable Software and Affected Versions SAP CommonCryptoLib affected versions not specified Description SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network. This can lead to memory corruption and...
