260 matches found
PT-2026-25809
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0 Description The software does not correctly handle array lengths reported within messages sent via WebSockets to the calls plugin...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the deserialization process of .msgpack files containing EXT32 objects. An attacker can exhaust system memory and cause service unavailability by submitting a specially crafted .msgpack fil...
Litestar allows unbounded resource consumption (DoS vulnerability)
Summary Litestar offers multiple methods to return a parsed representation of the request body, as well as extractors that rely on those parsers to map request content to structured data types. Multiple of those parsers do not have size limits when reading the request body into memory, which allo...
Fedora: Security Advisory (FEDORA-2024-e7bb8bc2da)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
WS-2017-3764
Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory...
[SECURITY] Fedora 40 Update: lua-mpack-1.0.12-1.fc40
mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...
[SECURITY] Fedora 39 Update: lua-mpack-1.0.12-1.fc39
mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...
[SECURITY] Fedora 41 Update: lua-mpack-1.0.12-1.fc41
mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...
MAL-2024-6471 Malicious code in activerecord-msgpack-serializer (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in activerecord-msgpack-serializer (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
arduinojson:msgpack_fuzzer: Heap-buffer-overflow in ArduinoJson::V704HB22::detail::MsgPackDeserializer<ArduinoJson::V704HB22::detail
Project: https://github.com/bblanchon/ArduinoJson.git Detailed Report: https://oss-fuzz.com/testcase?key=5354792971993088 Project: arduinojson Fuzzing Engine: libFuzzer Fuzz Target: msgpackfuzzer Job Type: libfuzzerasani386arduinojson Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1...
BIT-FLUENT-BIT-2021-46879
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...
Fedora: Security Advisory for golang-github-hashicorp-msgpack (FEDORA-2023-f122ea1b3e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 38 Update: golang-github-hashicorp-msgpack-2.1.0-1.fc38
High Performance, Feature-Rich Idiomatic codec/encoding library...
com.github.tkrs:aerospiker-core_2.11 (0.5.1), com.github.tkrs:aerospiker-core_2.12 (0.5.1) +4 more potentially affected by CVE-2023-36480 via com.aerospike:aerospike-client (3.3.2)
com.aerospike:aerospike-client MAVEN version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.aerospike:aerospike-client and may be impacted: - com.github.tkrs:aerospiker-core2.11 0.5.1 - com.github.tkrs:aerospiker-core2.12 0.5.1 -...
An issue was discovered in Treasure Data Fluent Bit 1.7.1 erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays leading to use-after-free. This can be used by an attacker to craft a specially craft file and trick the victim opening it using the affect software triggering use-after-free and execute arbitrary code on the target system.
...
An issue was discovered in Treasure Data Fluent Bit 1.7.1 a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malicious file and tick the victim to open the file with the software triggering a heap overflow and execute arbitrary code on the target system.
...
CVE-2021-46879
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...
CVE-2021-46878
An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...
CVE-2021-46879
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...