Updated libsoup3 & libsoup packages fix security vulnerabilities

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. CVE-2024-52530 GNOME libsoup before 3.6.1...

Denial Of Service (DoS)

litestar is vulnerable to Denial of Service DoS. The vulnerability is due to the multipart form parser, which expects the entire request body as a single byte string without a default size limit, allowing attackers to cause excessive memory consumption by uploading arbitrarily large files...

CBL Mariner 2.0 Security Update: libsoup (CVE-2024-52532)

The version of libsoup installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-52532 advisory. - GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain...

PYSEC-2024-178

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-52581

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-52581 Litestar allows unbounded resource consumption (DoS vulnerability)

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-52581 Litestar allows unbounded resource consumption (DoS vulnerability)

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-52581

CVE-2024-52581 affects Litestar (ASGI framework). The vulnerability arises in the multipart/form-data parsing path prior to version 2.13.0, where the parser reads the entire request body into memory without a size limit, enabling unbounded memory consumption (DoS) on large uploads. The issue is t...

GNOME libsoup before 3.6.1 has an infinite loop and memory consumption. during the reading of certain patterns of WebSocket data from clients.

...

CVE-2024-52918

Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption and application crash via a BIP21 r parameter for a URL that has a large file...

CVE-2024-52918

Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption and application crash via a BIP21 r parameter for a URL that has a large file...

CVE-2024-52915

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption via a crafted INV message...

CVE-2024-52915

CVE-2024-52915 affects Bitcoin Core before 0.20.0. The issue allows remote attackers to cause a denial-of-service via a crafted INV message that triggers memory consumption. Affected versions are prior to 0.20.0; remediation is to upgrade to version 0.20.0 or later. Public documents in the provid...

CVE-2024-52918

CVE-2024-52918 affects Bitcoin Core prior to 0.20.0, specifically Bitcoin-Qt. The vulnerability arises from processing a BIP21 r parameter in a URL that contains a large file, which can trigger memory consumption leading to a denial of service and application crash. Multiple connected sources (NV...

PT-2024-35483 · Unknown · Bitcoin Core

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.20.0 Description: The issue allows remote attackers to cause a denial of service, specifically through memory consumption, by sending a crafted INV message. Recommendations: For versions prior to 0.20.0, updat...

CVE-2024-52918

Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption and application crash via a BIP21 r parameter for a URL that has a large file...

CVE-2024-52915

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption via a crafted INV message...

CVE-2024-52915

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service memory consumption via a crafted INV message...

Fedora 40 : webkitgtk (2024-4d940908db)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4d940908db advisory. Update to WebKitGTK 2.46.3: Flatten layers to a plane when preseve-3d style is set. Fix DuckDuckGo links by adding a user agent quirk. Fix several...

Node.js: GOAWAY HTTP/2 frames cause memory leak outside heap

A memory leak could occur when a remote peer abruptly closed the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could have led to increased memory...