Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the concat function. An attacker can trigger an integer overflow by supplying input with an excessive number of separators and arguments. Note: This vulnerability has also been published as CVE-2025-327...

CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concatws SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string e.g., 2MB or more, an integer overflow occurs in calculating the size of the...

CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concatws SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string e.g., 2MB or more, an integer overflow occurs in calculating the size of the...

SQLite 安全漏洞

SQLite is a lightweight database from the SQLite open source, a relational database management system that adheres to ACID. A security vulnerability exists in SQLite version 3.49.0, which stems from a concat function that could lead to an integer overflow...

CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concatws SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string e.g., 2MB or more, an integer overflow occurs in calculating the size of the...

CVE-2025-29087

CVE-2025-29087 concerns SQLite: concat_ws() can write beyond the end of a malloc’d buffer in versions 3.44.0–3.49.0 when a large, attacker-controlled separator is supplied, triggering an integer overflow while sizing the result buffer. This may lead to memory corruption or a crash. A fix is avail...

CVE-2025-29087

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concatws SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string e.g., 2MB or more, an integer overflow occurs in calculating the size of the...

PT-2025-15279

Name of the Vulnerable Software and Affected Versions Sqlite version 3.49.0 Description The issue is related to an integer overflow in the concat function. Recommendations For Sqlite version 3.49.0, at the moment, there is no information about a newer version that contains a fix for this...

SUSE CVE-2024-57947

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfsetpipapo: fix initial map fill The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result a...

TensorFlow has null dereference on ParallelConcat with XLA

...

CVE-2024-22419

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of co...

CVE-2024-22419

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The "concat" built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the "buildIR" for "concat" doesn't properly adhere to the API...

Vyper Buffer Error Vulnerability

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A buffer error vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from allowing concat to write to memory buffer boundaries built-in, thereby overwriting existing valid data...

CVE-2024-22419: Buffer Copy without Checking Size of Input

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of co...

PT-2024-19409 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.0 through 0.3.9 Description: The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the build IR for concat doesn't proper...

Medium: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. Thi...

binutils:fuzz_objcopy: Use-of-uninitialized-value in concat

Detailed Report: https://oss-fuzz.com/testcase?key=4837740180799488 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjcopy Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: concat copyfile copymain Sanitizer: memory...

The vulnerability of Eclipse Jetty servlet containers, related to the lack of protection for service data, allows attackers to obtain confidential information.

The vulnerability of the concat server servlet in Eclipse Jetty is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to obtain confidential information remotely...

Node.js: HTTP Request Smuggling via Empty headers separated by CR

HTTP Request Smuggling HRS was possible in Node.js v20.2.0 due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. The CR character without LF was sufficient to delimit HTTP header fields in the llhttp parser, which is not compliant with RFC7230...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS when running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. PoC import tensorflow as tf func = tf.rawops.ParallelConcat...